Veracode Vulnerability DatabaseVERACODE:4691Cross-Site Request Forgery(CSRF)
7.1 High
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
COMPLETE
AV:N/AC:M/Au:N/C:N/I:N/A:C
Moodle is vulnerable to cross-site request forgery (CSRF) attacks. The attacks exist because it does not properly check session key validity on password-protected lesson modules, allowing the authenticated users to hijack the request sent to (1) mod/lesson/mediafile.php or (2) mod/lesson/view.php.
| CPE | Name | Operator | Version |
|---|---|---|---|
| moodle/moodle | le | 2.8.8 | |
| moodle/moodle | le | 2.7.10 | |
| moodle/moodle | le | 2.6.11 | |
| moodle/moodle | le | 2.9.2 |
References
ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2015-009.txt.asc
kb.juniper.net/InfoCenter/index?page=content&id=JSA10686
www.securitytracker.com/id/1032842
www.securitytracker.com/id/1033007
www.securitytracker.com/id/1033915
git.moodle.org/gw?p=moodle.git;a=commit;h=541c5b8552e0162010d0259c90a04eb63e875958
kc.mcafee.com/corporate/index?page=content&id=SB10128
moodle.org/mod/forum/discuss.php?d=323233
security-tracker.debian.org/tracker/CVE-2015-5338
Related
7.1 High
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
COMPLETE
AV:N/AC:M/Au:N/C:N/I:N/A:C