moodle -- multiple vulnerabilities

2016-03-2100:00:00

vuxml.freebsd.org

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS

0.003

Percentile

70.3%

JSON

Marina Glancy reports:

MSA-16-0003: Incorrect capability check when displaying
users emails in Participants list
MSA-16-0004: XSS from profile fields from external db

MSA-16-0005: Reflected XSS in mod_data advanced search

MSA-16-0006: Hidden courses are shown to students in Event
Monitor
MSA-16-0007: Non-Editing Instructor role can edit exclude
checkbox in Single View
MSA-16-0008: External function get_calendar_events return
events that pertains to hidden activities
MSA-16-0009: CSRF in Assignment plugin management page

MSA-16-0010: Enumeration of category details possible without
authentication
MSA-16-0011: Add no referrer to links with _blank target
attribute
MSA-16-0012: External function mod_assign_save_submission
does not check due dates

OSVersionArchitecturePackageVersionFilename
FreeBSDanynoarchmoodle28< 2.8.11UNKNOWN
FreeBSDanynoarchmoodle29< 2.9.5UNKNOWN
FreeBSDanynoarchmoodle30< 3.0.3UNKNOWN