 |
Home ▼ Bookkeeping
Online ▼ Security
Audits ▼
Managed
DNS ▼
About
Order
FAQ
Acceptable Use Policy
Dynamic DNS Clients
Configure Domains Dyanmic DNS Update Password Network
Monitor ▼
Enterprise Package
Advanced Package
Standard Package
Free Trial
FAQ
Price/Feature Summary
Order/Renew
Examples
Configure/Status Alert Profiles | ||
| Test ID: | 1.3.6.1.4.1.25623.1.0.800240 |
| Category: | Web application abuses |
| Title: | Moodle CMS Multiple Vulnerabilities |
| Summary: | Moodle CMS is prone to Multiple Vulnerabilities. |
| Description: | Summary: Moodle CMS is prone to Multiple Vulnerabilities. Vulnerability Insight: Multiple flaws are due to - Vulnerability in post.php for IMG tag which allows unauthorised access to user's posts. - XSS Vulnerability in course/lib.php which allows injection of arbitrary web scripts or malicious HTML codes while displaying the log report in browser due to lack of sanitization. - Unspecified vulnerability in the Calendar export feature which causes conducting brute force attacks. - XSS Vulnerability in blocks/html/block_html.php which allows injection of arbitracy scripts of malformed HTML codes injection. Vulnerability Impact: Successful exploitation will allow remote attackers to cause Cross Site Scripting attacks, can gain sensitive information about the user or the remote host or can delete unauthorised posts through injecting malicious web scripts. Affected Software/OS: Moodle version from 1.6 prior to 1.6.9, Moodle version from 1.7 prior to 1.7.7, Moodle version from 1.8 prior to 1.8.8 and Moodle version from 1.9 prior to 1.9.4 on all platforms. Solution: Upgrade to latest version 1.6.9, 1.7.7, 1.8.8 and 1.9.4. CVSS Score: 6.4 CVSS Vector: AV:N/AC:L/Au:N/C:N/I:P/A:P |
| Cross-Ref: |
Common Vulnerability Exposure (CVE) ID: CVE-2009-0499 http://www.openwall.com/lists/oss-security/2009/02/04/1 http://secunia.com/advisories/34418 SuSE Security Announcement: SUSE-SR:2009:007 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00004.html Common Vulnerability Exposure (CVE) ID: CVE-2009-0500 Debian Security Information: DSA-1724 (Google Search) http://www.debian.org/security/2009/dsa-1724 http://secunia.com/advisories/33955 Common Vulnerability Exposure (CVE) ID: CVE-2009-0501 Common Vulnerability Exposure (CVE) ID: CVE-2009-0502 |
| Copyright | Copyright (C) 2009 Greenbone AG |
| This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below. |