PT-2014-3432 · Moodle · Moodle

Jun Zhu

·

Publicado

2014-01-20

·

Atualizado

2020-12-01

·

CVE-2014-0010

CVSS v2.0

6.8

Média

VetorAV:N/AC:M/Au:N/C:P/I:P/A:P
Name of the Vulnerable Software and Affected Versions Moodle versions 2.2.11 and earlier, 2.3.x before 2.3.11, 2.4.x before 2.4.8, 2.5.x before 2.5.4, 2.6.x before 2.6.1
Description The issue allows remote attackers to hijack the authentication of administrators for requests, specifically to delete categories or fields, due to multiple cross-site request forgery (CSRF) vulnerabilities in the user/profile/index.php file.
Recommendations For Moodle versions 2.2.11 and earlier, update to version 2.2.12 or later. For Moodle versions 2.3.x before 2.3.11, update to version 2.3.11 or later. For Moodle versions 2.4.x before 2.4.8, update to version 2.4.8 or later. For Moodle versions 2.5.x before 2.5.4, update to version 2.5.4 or later. For Moodle versions 2.6.x before 2.6.1, update to version 2.6.1 or later.

Correção

CSRF

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2014-0010
MGASA-2014-0053

Produtos afetados

Moodle