Multiple security vulnerabilities in Moodle

Release date:
Updated on:

Affected Systems:
Moodle 2.x
Unaffected system:
Moodle 2.2.3
Moodle 2.1.6
Moodle 2.0.9
Description:
--------------------------------------------------------------------------------
Bugtraq id: 53632
Cve id: CVE-2012-2358, CVE-2012-2359, CVE-2012-2360, CVE-2012-2361, CVE-2012-2365

Moodle is a course Management System (CMS), also known as Learning Management System (LMS) or virtual learning environment (VLE ). It is a free web application. Teachers can use it to build efficient online learning websites.

Moodle has multiple HTML injection vulnerabilities, XSS vulnerabilities, and security restriction bypass vulnerabilities. Attackers can exploit these vulnerabilities to execute HTML and arbitrary script code, attackers can steal Cookie authentication creden。 or bypass security restrictions to obtain sensitive information and perform illegal operations.

<* Source: Amanda mongohty

Link: http://moodle.org/mod/forum/discuss.php? D = 203048
Http://moodle.org/mod/forum/discuss.php? D = 203049
Http://moodle.org/mod/forum/discuss.php? D = 203050
Http://moodle.org/mod/forum/discuss.php? D = 203055
Http://moodle.org/mod/forum/discuss.php? D = 203056
*>

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:

Moodle
------
Moodle has released a Security Bulletin (MSA-12-0037) and patches for this:

MSA-12-0037: Write access issue in Database activity module

Link: http://moodle.org/mod/forum/discuss.php? D = 203056