Moodle 2.1.x < 2.1.8 Multiple Vulnerabilities

2016-07-2100:00:00

Tenable

www.tenable.com

CVSS2

5.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:P/A:N

EPSS

0.003

Percentile

70.5%

JSON

The remote web server hosts Moodle, an open-source course management system. Versions of Moodle 2.1.x prior to 2.1.8 are exposed to the following vulnerabilities :

A flaw exists that is triggered when the ‘webservice/lib.php’ script fails to properly limit tokens to the service that issued them. This may allow a remote attacker to use a token intended for one service to gain access to arbitrary other external services. (CVE-2012-4402)
A flaw exists that may lead to an unauthorized information disclosure. The issue is triggered when the ‘lib/filelib.php’ script does not properly check the publication state of blog files. This may allow a remote attacker to gain access to the embedded files of the blog before it is published. (CVE-2012-4407)
A flaw exists when permissions are not properly verified on the reset page. This may allow a remote attacker to reset a course via the reset page. (CVE-2012-4408)