PT-2015-1605 · Moodle · Moodle

Ankit Agarwal · Publicado 2015-01-20 · Atualizado 2022-05-13 · CVE-2015-0213

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Moodle versions prior to 2.5.10 Moodle versions 2.6.x through 2.6.6 Moodle versions 2.7.x through 2.7.3 Moodle versions 2.8.x through 2.8.1

Description The issue is related to cross-site request forgery (CSRF) in the Glossary module. This can allow a remote attacker to hijack the authentication of victims.

Recommendations For versions 2.5.x, update to version 2.5.10 or later. For versions 2.6.x, update to version 2.6.7 or later. For versions 2.7.x, update to version 2.7.4 or later. For versions 2.8.x, update to version 2.8.2 or later.

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

BDU:2015-10938

CVE-2015-0213

GHSA-HHQ7-JF2P-HW9C

MGASA-2015-0032

Produtos afetados

Moodle

Referências · 26

• https://github.com/moodle/moodle · Nota
• https://github.com/moodle/moodle/commit/e83c756f84e16ab70e160e08deb84e9bc4bfbfea · Nota
• https://github.com/moodle/moodle/commit/5770e5147838aa06a3ecdff6fc3aebbbd17fff90 · Nota
• https://github.com/moodle/moodle/commit/c4250ef4f23776ff4862d2860b6be2cf7b2d85f6 · Nota
• http://openwall.com/lists/oss-security/2015/01/19/1 · Nota
• https://moodle.org/mod/forum/discuss.php?d=278613 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2015-10938 · Nota de Segurança
• https://docs.moodle.org/dev/Moodle_2.6.7_release_notes · Nota
• https://ubuntu.com/security/CVE-2015-0213 · Aviso do Fabricante
• https://moodle.org/mod/forum/discuss.php?d=278612 · Nota
• https://moodle.org/mod/forum/discuss.php?d=278614 · Nota
• https://moodle.org/mod/forum/discuss.php?d=278611 · Nota
• https://osv.dev/vulnerability/GHSA-hhq7-jf2p-hw9c · Aviso do Fabricante
• http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-48106 · Nota
• https://moodle.org/mod/forum/discuss.php?d=278617 · Nota