login/token.php in Moodle through 2.3.11, 2.4.x before 2.4.10, 2.5.x before 2.5.6, and 2.6.x before 2.6.3 creates a MoodleMobile web-service token with an infinite lifetime, which makes it easier for remote attackers to hijack sessions via a brute-force attack.

The remote web server hosts Moodle, an open-source course management system. Versions of Moodle 2.4.x prior to 2.4.10, 2.5.x prior to 2.5.6, 2.6.x prior to 2.6.3, and all previous releases are exposed to the following vulnerabilities :

  - A cross-site request forgery (CSRF) vulnerability affects the quick-grading function. Session checking was not being performed correctly in Assignment's quick-grading, allowing forged requests to be made unknowingly by authenticated users. (MSA-14-0014 / CVE-2014-0213)

  - A security bypass weakness affects session Token expiration in MoodleMobile. Tokens created automatically in 'login/token.php' are valid forever. (MSA-14-0015 / CVE-2014-0214)

  - An information disclosure flaw which exposes student details through the use of a screen reader or viewing the HTML source code. (MSA-14-0016 / CVE-2014-0215)

  - An authorization bypass vulnerability exists because it fails to restrict access to the files linked in HTML blocks on 'My Home' page. Successful exploits will allow attackers to gain unauthorized access to these files. (MSA-14-0017 / CVE-2014-0216)

  - An information disclosure flaw that may allow a remote attacker to gain access to the details of hidden courses on enrollment pages via URL manipulation. (MSA-14-0018 / CVE-2014-0217)

  - A reflected cross-site scripting (XSS) vulnerability affects the URL downloader repository due to a lack of filtering. (MSA-14-0019 / CVE-2014-0218)

Moodle upstream has released versions 2.7, 2.6.3, 2.5.6, and 2.4.10 to fix the following security flaws :

CVE-2014-0213 MSA-14-0014: Cross-site request forgery possible in Assignment CVE-2014-0214 MSA-14-0015: Web service token expiry issue for MoodleMobile CVE-2014-0215 MSA-14-0016: Anonymous student identity revealed in assignment CVE-2014-0216 MSA-14-0017: File access issue in HTML block CVE-2014-0217 MSA-14-0018: Information leak in courses CVE-2014-0218 MSA-14-0019: Reflected XSS in URL downloader repository

For a full summary and patch links, refer to the following :

http://seclists.org/oss-sec/2014/q2/329

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
8716	Moodle < 2.4 / 2.4.x < 2.4.10 / 2.5.x < 2.5.6 / 2.6.x < 2.6.3 Multiple Vulnerabilities	Nessus Network Monitor	CGI	medium
74238	Fedora 20 : moodle-2.5.6-1.fc20 (2014-6585)	Nessus	Fedora Local Security Checks	medium
74237	Fedora 19 : moodle-2.4.10-1.fc19 (2014-6577)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2014-0214

critical

Tenable Plugins

medium

medium

medium