Cross-site Request Forgery (CSRF)

2017-07-1214:46:42

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

0.003 Low

EPSS

Percentile

70.3%

JSON

Moodle is vulnerable to cross-site request forgery (CSRF) attacks. The library does not check a user’s session key before letting them execute actions on custom profile fields and categories. This can allow a malicious user without the proper permissions to edit the custom fields and categories.

CPENameOperatorVersion
moodle/moodlele2.5.3
moodle/moodlele2.6.0
moodle/moodlele2.2.11
moodle/moodlele2.3.10
moodle/moodlele2.4.7

Name	Operator	Version
moodle/moodle	le	2.5.3
moodle/moodle	le	2.6.0
moodle/moodle	le	2.2.11
moodle/moodle	le	2.3.10
moodle/moodle	le	2.4.7

References

git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-42883

lists.fedoraproject.org/pipermail/package-announce/2014-January/127510.html

lists.fedoraproject.org/pipermail/package-announce/2014-January/127533.html

openwall.com/lists/oss-security/2014/01/20/1

osvdb.org/102261

www.securitytracker.com/id/1029649

git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-42883

moodle.org/mod/forum/discuss.php?d=252416

0.003 Low

EPSS

Percentile

70.3%

JSON

Related for VERACODE:4563