Moodle CVEs — known vulnerabilities

Moodle MEDIUM 6.8

CVE-2011-4287

admin/uploaduser_form.php in Moodle 2.0.x before 2.0.3 does not force password changes for autosubscribed users, which makes it easier for remote att…

Mitigation only

Fix from $1,600 2012-07-16

Moodle MEDIUM 5.5

CVE-2011-4285

The default configuration of Moodle 2.0.x before 2.0.2 has an incorrect setting of the moodle/course:delete capability, which allows remote authentic…

Mitigation only

Fix from $1,600 2012-07-16

Moodle MEDIUM 5.0

CVE-2011-4279

Moodle 2.0.x before 2.0.2 does not use the forceloginforprofiles setting for course-profiles access control, which makes it easier for remote attacke…

Mitigation only

Fix from $1,600 2012-07-16

Moodle MEDIUM 5.0

CVE-2011-4283

Moodle 1.9.x before 1.9.11 and 2.0.x before 2.0.2 places an IMS enterprise enrolment file in the course-files area, which allows remote attackers to …

Mitigation only

Fix from $1,600 2012-07-16

Moodle MEDIUM 5.0

CVE-2011-4284

Moodle 2.0.x before 2.0.2 allows remote attackers to obtain sensitive information from a myprofile (aka My profile) block by visiting a user-context …

Mitigation only

Fix from $1,600 2012-07-16

Moodle MEDIUM 5.0

CVE-2011-4309

Moodle 2.0.x before 2.0.5 and 2.1.x before 2.1.2 allows remote attackers to bypass intended access restrictions and perform global searches by levera…

Mitigation only

Fix from $1,600 2012-07-11

Moodle MEDIUM 6.8

CVE-2011-4298

Multiple cross-site request forgery (CSRF) vulnerabilities in mod/wiki/ components in Moodle 2.0.x before 2.0.5 and 2.1.x before 2.1.2 allow remote a…

Patch available

Fix from $1,600 2012-07-11

Moodle MEDIUM 6.8

CVE-2011-4302

mnet/xmlrpc/client.php in MNET in Moodle 1.9.x before 1.9.14, 2.0.x before 2.0.5, and 2.1.x before 2.1.2 does not properly process the return value o…

Patch available

Fix from $1,600 2012-07-11

Moodle MEDIUM 5.0

CVE-2011-4300

The file_browser component in Moodle 2.0.x before 2.0.5 and 2.1.x before 2.1.2 does not properly restrict access to category and course data, which a…

Patch available

Fix from $1,600 2012-07-11

Moodle MEDIUM 5.0

CVE-2011-4301

The MoodleQuickForm class in the Forms Library in lib/formslib.php in Moodle 1.9.x before 1.9.14, 2.0.x before 2.0.5, and 2.1.x before 2.1.2 does not…

Mitigation only

Fix from $1,600 2012-07-11

Moodle MEDIUM 5.0

CVE-2011-4203

CRLF injection vulnerability in calendar/set.php in the Calendar component in Moodle 1.9.x before 1.9.15, 2.0.x before 2.0.6, 2.1.x before 2.1.3, and…

No fix yet

Fix from $1,600 2011-12-22

Moodle MEDIUM 5.0

CVE-2011-3757

Moodle 2.0.1 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an e…

No fix yet

Fix from $1,600 2011-09-23

Moodle MEDIUM 6.8

CVE-2010-2231

Cross-site request forgery (CSRF) vulnerability in report/overview/report.php in the quiz module in Moodle before 1.8.13 and 1.9.x before 1.9.9 allow…

Fix: after 1.8.12

Fix from $1,600 2010-06-28

Moodle HIGH 7.5

CVE-2010-1615

Multiple SQL injection vulnerabilities in Moodle 1.8.x before 1.8.12 and 1.9.x before 1.9.8 allow remote attackers to execute arbitrary SQL commands …

Mitigation only

Fix from $1,950 2010-04-29

Moodle MEDIUM 6.8

CVE-2010-1613

Moodle 1.8.x and 1.9.x before 1.9.8 does not enable the "Regenerate session id during login" setting by default, which makes it easier for remote att…

Mitigation only

Fix from $1,600 2010-04-29

Moodle HIGH 7.5

CVE-2009-4304

Moodle 1.8 before 1.8.11 and 1.9 before 1.9.7 does not use a random password salt in config.php, which makes it easier for attackers to conduct brute…

Patch available

Fix from $1,950 2009-12-16

Moodle MEDIUM 6.8

CVE-2009-4297

Multiple cross-site request forgery (CSRF) vulnerabilities in Moodle 1.8 before 1.8.11 and 1.9 before 1.9.7 allow remote attackers to hijack the auth…

Patch available