Moodle 2.2.x < 2.2.11 Multiple Vulnerabilities

Medium Nessus Network Monitor Plugin ID 9415

Synopsis

The remote web server is hosting a web application that is vulnerable to multiple attack vectors.

Description

The remote web server hosts Moodle, an open-source course management system. Versions of Moodle 2.2.x prior to 2.2.11 are exposed to the following vulnerabilities :

- A flaw exists in 'mod/chat/gui_sockets/index.php' that is due to the program failing to properly check for access. This may allow a remote attacker to access a daemon-mode Chat activity without proper permissions. (CVE-2013-2242)
- A flaw exists that may lead to the unauthorized disclosure of sensitive information. The issue is due to block information related to the person being impersonated being shown shown along with an error message when an attacker is attempting to impersonate another user using RSS tokens. This may allow a remote attacker to gain access to sensitive information. (CVE-2013-2245)
- A flaw exists that may lead to the unauthorized disclosure of sensitive information. The issue is due to the feedback module failing to properly check for privileges in 'feedback/lib.php'. This will result in personal information being exposed to a remote attacker. (CVE-2013-2246)
- A flaw exists in the IMS-LTI (External tool) module that may lead to the unauthorized disclosure of sensitive information. The issue is due to the program not allowing users to change privacy settings, which will result in personal information always being transferred. This may allow a remote attacker to gain access to sensitive information. (CVE-2013-4938)

Solution

Upgrade to Moodle version 2.2.11 or later.

See Also

https://docs.moodle.org/dev/Moodle_2.2.11_release_notes

Plugin Details

Severity: Medium

ID: 9415

File Name: 9415.prm

Family: CGI

Published: 2016/07/21

Modified: 2016/07/21

Dependencies: 8690

Risk Information

Risk Factor: Medium

CVSSv2

Base Score: 5

Temporal Score: 4.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N

Temporal Vector: CVSS2#E:ND/RL:OF/RC:C

CVSSv3

Base Score: 5.3

Temporal Score: 5.1

Vector: CVSS3#AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Temporal Vector: CVSS3#E:X/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:moodle:moodle

Patch Publication Date: 2013/07/15

Vulnerability Publication Date: 2013/07/15

Reference Information

CVE: CVE-2013-2242, CVE-2013-2245, CVE-2013-2246, CVE-2013-4938

BID: 61178, 61184, 61187, 61522