Access Restriction Bypass

Moodle is vulnerable to access restriction bypass. The attacks exist because mod/chat/guisockets/index.php does not check for privileges for access to a daemon-mode Chat activity, allowing a malicious user unauthorized access to daemon-mode Chat activity...

Moodle 2.5.x < 2.5.5 Multiple Vulnerabilities

Binary data 9423.prm...

CVE-2014-0122

mod/chat/chatajax.php in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 does not properly check for the mod/chat:chat capability during chat sessions, which allows remote authenticated users to bypass intended access restrictions in opportunistic circumstanc...

CVE-2014-0122: Undefined Security Weakness

mod/chat/chatajax.php in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 does not properly check for the mod/chat:chat capability during chat sessions, which allows remote authenticated users to bypass intended access restrictions in opportunistic circumstanc...

PT-2014-3483

Name of the Vulnerable Software and Affected Versions Moodle versions 2.3.11 and earlier, 2.4.x through 2.4.8, 2.5.x through 2.5.4, 2.6.x through 2.6.1 Description The issue allows remote authenticated users to bypass intended access restrictions by remaining in a chat session after an...

CVE-2013-2242

mod/chat/guisockets/index.php in Moodle through 2.1.10, 2.2.x before 2.2.11, 2.3.x before 2.3.8, 2.4.x before 2.4.5, and 2.5.x before 2.5.1 does not consider the mod/chat:chat capability before authorizing daemon-mode chat, which allows remote authenticated users to bypass intended access...

CVE-2013-2242: Undefined Security Weakness

mod/chat/guisockets/index.php in Moodle through 2.1.10, 2.2.x before 2.2.11, 2.3.x before 2.3.8, 2.4.x before 2.4.5, and 2.5.x before 2.5.1 does not consider the mod/chat:chat capability before authorizing daemon-mode chat, which allows remote authenticated users to bypass intended access...

PT-2013-3617

Name of the Vulnerable Software and Affected Versions Moodle versions 2.1.10 and earlier, 2.2.x before 2.2.11, 2.3.x before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.1 Description The issue allows remote authenticated users to bypass intended access restrictions via an HTTP session to a chat...

CVE-2007-6213

CVE-2007-6213 concerns WebED 0.0.9. Multiple directory traversal flaws in mod/chat/index.php allow remote reading of arbitrary files via a .. in the Root and Path parameters, affecting confidentiality (C:P) with no integrity/availability impact stated. CVSS v2 score is 5.0 (Medium) with network a...

CVE-2007-6213: Improper Limitation of a Pathname to a Restricted Directory

Multiple directory traversal vulnerabilities in mod/chat/index.php in WebED 0.0.9 allow remote attackers to read arbitrary files via a .. dot dot in the 1 Root and 2 Path parameters...