CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Moodle » Moodle : Security Vulnerabilities

CVSS Scores Greater Than: 0   1   2   3   4   5   6   7   8   9  
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2017-7532 284 2017-07-17 2017-07-19
4.0
 None Remote Low Single system None Partial None
In Moodle 3.x, course creators are able to change system default settings for courses.
2 CVE-2017-7531 200 +Info 2017-07-17 2017-07-19
4.0
 None Remote Low Single system Partial None None
In Moodle 3.3, the course overview block reveals activities in hidden courses.
3 CVE-2017-7491 352 CSRF 2017-05-15 2017-05-23
4.3
 None Remote Medium Not required None Partial None
In Moodle 2.x and 3.x, a CSRF attack is possible that allows attackers to change the "number of courses displayed in the course overview block" configuration setting.
4 CVE-2017-7490 264 2017-05-15 2017-05-23
5.0
 None Remote Low Not required Partial None None
In Moodle 2.x and 3.x, searching of arbitrary blogs is possible because a capability check is missing.
5 CVE-2017-7489 264 2017-05-15 2017-05-23
6.5
 None Remote Low Single system Partial Partial Partial
In Moodle 2.x and 3.x, remote authenticated users can take ownership of arbitrary blogs by editing an external blog link.
6 CVE-2017-7298 79 XSS 2017-03-29 2017-03-30
3.5
 None Remote Medium Single system None Partial None
In Moodle 3.2.2+, there is XSS in the Course summary filter of the "Add a new course" page, as demonstrated by a crafted attribute of an SVG element.
7 CVE-2017-2645 79 XSS 2017-03-26 2017-07-11
4.3
 None Remote Medium Not required None Partial None
In Moodle 3.x, XSS can occur via attachments to evidence of prior learning.
8 CVE-2017-2644 79 XSS 2017-03-26 2017-07-11
4.3
 None Remote Medium Not required None Partial None
In Moodle 3.x, XSS can occur via evidence of prior learning.
9 CVE-2017-2643 200 +Info 2017-03-26 2017-07-11
5.0
 None Remote Low Not required Partial None None
In Moodle 3.2.x, global search displays user names for unauthenticated users.
10 CVE-2017-2642 200 +Info 2017-07-17 2017-07-19
4.0
 None Remote Low Single system Partial None None
Moodle 3.x has user fullname disclosure on the user preferences page.
11 CVE-2017-2641 89 Sql 2017-03-26 2017-08-15
7.5
 None Remote Low Not required Partial Partial Partial
In Moodle 2.x and 3.x, SQL injection can occur via user preferences.
12 CVE-2017-2578 79 XSS 2017-01-20 2017-01-25
4.3
 None Remote Medium Not required None Partial None
In Moodle 3.x, there is XSS in the assignment submission page.
13 CVE-2017-2576 20 2017-01-20 2017-01-25
5.0
 None Remote Low Not required None Partial None
In Moodle 2.x and 3.x, there is incorrect sanitization of attributes in forums.
14 CVE-2016-9188 79 XSS 2016-11-04 2016-11-29
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerabilities in Moodle CMS on or before 3.1.2 allow remote attackers to inject arbitrary web script or HTML via the s_additionalhtmlhead, s_additionalhtmltopofbody, and s_additionalhtmlfooter parameters.
15 CVE-2016-9187 434 Exec Code 2016-11-04 2016-11-29
6.5
 None Remote Low Single system Partial Partial Partial
Unrestricted file upload vulnerability in the double extension support in the "image" module in Moodle 3.1.2 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, and then accessing it via unspecified vectors.
16 CVE-2016-9186 434 Exec Code 2016-11-04 2016-11-29
6.5
 None Remote Low Single system Partial Partial Partial
Unrestricted file upload vulnerability in the "legacy course files" and "file manager" modules in Moodle 3.1.2 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, and then accessing it via unspecified vectors.
17 CVE-2016-8644 264 2017-01-20 2017-01-25
5.0
 None Remote Low Not required Partial None None
In Moodle 2.x and 3.x, the capability to view course notes is checked in the wrong context.
18 CVE-2016-8643 284 2017-01-20 2017-01-25
4.0
 None Remote Low Single system None Partial None
In Moodle 2.x and 3.x, non-admin site managers may accidentally edit admins via web services.
19 CVE-2016-8642 284 2017-01-20 2017-01-25
5.0
 None Remote Low Not required Partial None None
In Moodle 2.x and 3.x, the question engine allows access to files that should not be available.
20 CVE-2016-7919 89 Sql +Info 2016-10-28 2016-12-02
5.0
 None Remote Low Not required Partial None None
** DISPUTED ** Moodle 3.1.2 allows remote attackers to obtain sensitive information via unspecified vectors, related to a "SQL Injection" issue affecting the Administration panel function in the installation process component. NOTE: the vendor disputes the relevance of this report, noting that "the person who is installing Moodle must know database access credentials and they can access the database directly; there is no need for them to create a SQL injection in one of the installation dialogue fields."
21 CVE-2016-7038 640 2017-01-20 2017-01-25
5.0
 None Remote Low Not required Partial None None
In Moodle 2.x and 3.x, web service tokens are not invalidated when the user password is changed or forced to be changed.
22 CVE-2016-5014 200 +Info 2017-01-20 2017-01-25
5.8
 None Remote Medium Not required Partial Partial None
In Moodle 2.x and 3.x, an unenrolled user still receives event monitor notifications even though they can no longer access the course.
23 CVE-2016-5013 74 2017-01-20 2017-01-25
5.8
 None Remote Medium Not required Partial Partial None
In Moodle 2.x and 3.x, text injection can occur in email headers, potentially leading to outbound spam.
24 CVE-2016-5012 200 +Info 2017-01-20 2017-01-25
5.0
 None Remote Low Not required Partial None None
In Moodle 3.x, glossary search displays entries without checking user permissions to view them.
25 CVE-2016-3734 352 CSRF 2017-04-20 2017-04-27
6.8
 None Remote Medium Not required Partial Partial Partial
Cross-site request forgery (CSRF) vulnerability in markposts.php in Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, 2.8 through 2.8.11, 2.7 through 2.7.13 and earlier allows remote attackers to hijack the authentication of users for requests that marks forum posts as read.
26 CVE-2016-3733 284 2017-04-20 2017-04-28
4.0
 None Remote Low Single system None Partial None
The "restore teacher" feature in Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, 2.8 through 2.8.11, 2.7 through 2.7.13, and earlier allows remote authenticated users to overwrite the course idnumber.
27 CVE-2016-3732 200 +Info 2017-04-20 2017-04-27
4.0
 None Remote Low Single system Partial None None
The capability check to access other badges in Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, 2.8 through 2.8.11, 2.7 through 2.7.13, and earlier allows remote authenticated users to read the badges of other users.
28 CVE-2016-3731 200 +Info 2017-04-20 2017-04-27
5.0
 None Remote Low Not required Partial None None
Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, and 2.8 through 2.8.11 allows remote attackers to obtain the names of hidden forums and forum discussions.
29 CVE-2016-3729 284 2017-04-20 2017-04-27
4.0
 None Remote Low Single system None Partial None
The user editing form in Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, 2.8 through 2.8.11, 2.7 through 2.7.13, and earlier allows remote authenticated users to edit profile fields locked by the administrator.
30 CVE-2016-2190 264 +Info 2016-05-22 2016-05-24
5.0
 None Remote Low Not required Partial None None
Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 does not properly restrict links, which allows remote attackers to obtain sensitive URL information by reading a Referer log.
31 CVE-2016-2159 284 Bypass 2016-05-22 2016-05-24
4.0
 None Remote Low Single system None Partial None
The save_submission function in mod/assign/externallib.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 allows remote authenticated users to bypass intended due-date restrictions by leveraging the student role for a web-service request.
32 CVE-2016-2158 200 +Info 2016-05-22 2016-05-24
4.0
 None Remote Low Single system Partial None None
lib/ajax/getnavbranch.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3, when the forcelogin feature is enabled, allows remote attackers to obtain sensitive category-detail information from the navigation branch by leveraging the guest role for an Ajax request.
33 CVE-2016-2157 352 CSRF 2016-05-22 2016-05-24
6.8
 None Remote Medium Not required Partial Partial Partial
Cross-site request forgery (CSRF) vulnerability in mod/assign/adminmanageplugins.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 allows remote attackers to hijack the authentication of administrators for requests that manage Assignment plugins.
34 CVE-2016-2156 200 +Info 2016-05-22 2016-05-24
4.0
 None Remote Low Single system Partial None None
calendar/externallib.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 provides calendar-event data without considering whether an activity is hidden, which allows remote authenticated users to obtain sensitive information via a web-service request.
35 CVE-2016-2155 264 2016-05-22 2016-05-24
4.0
 None Remote Low Single system None Partial None
The grade-reporting feature in Singleview (aka Single View) in Moodle 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 does not consider the moodle/grade:manage capability, which allows remote authenticated users to modify "Exclude grade" settings by leveraging the Non-Editing Instructor role.
36 CVE-2016-2154 200 +Info 2016-05-22 2016-05-24
4.0
 None Remote Low Single system Partial None None
admin/tool/monitor/lib.php in Event Monitor in Moodle 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 does not consider the moodle/course:viewhiddencourses capability, which allows remote authenticated users to discover hidden course names by subscribing to a rule.
37 CVE-2016-2153 79 XSS 2016-05-22 2016-05-24
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in the advanced-search feature in mod_data in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 allows remote attackers to inject arbitrary web script or HTML via a crafted field in a URL, as demonstrated by a search form field.
38 CVE-2016-2152 79 XSS 2016-05-22 2016-05-24
4.3
 None Remote Medium Not required None Partial None
Multiple cross-site scripting (XSS) vulnerabilities in auth/db/auth.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 allow remote attackers to inject arbitrary web script or HTML via an external DB profile field.
39 CVE-2016-2151 200 +Info 2016-05-22 2016-05-24
4.0
 None Remote Low Single system Partial None None
user/index.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 grants excessive authorization on the basis of the moodle/course:viewhiddenuserfields capability, which allows remote authenticated users to discover student e-mail addresses by leveraging the teacher role and reading a Participants list.
40 CVE-2016-0725 79 XSS 2016-02-22 2016-08-02
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in the search_pagination function in course/classes/management_renderer.php in Moodle 2.8.x before 2.8.10, 2.9.x before 2.9.4, and 3.0.x before 3.0.2 allows remote attackers to inject arbitrary web script or HTML via a crafted search string.
41 CVE-2016-0724 264 +Info 2016-02-22 2016-08-17
4.0
 None Remote Low Single system Partial None None
The (1) core_enrol_get_course_enrolment_methods and (2) enrol_self_get_instance_info web services in Moodle through 2.6.11, 2.7.x before 2.7.12, 2.8.x before 2.8.10, 2.9.x before 2.9.4, and 3.0.x before 3.0.2 do not consider the moodle/course:viewhiddencourses capability, which allows remote authenticated users to obtain sensitive information via a web-service request.
42 CVE-2015-5342 264 Bypass 2016-02-22 2016-03-02
4.0
 None Remote Low Single system None Partial None
The choice module in Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3 allows remote authenticated users to bypass intended access restrictions by visiting a URL to add or delete responses in the closed state.
43 CVE-2015-5341 264 Bypass 2016-02-22 2016-03-02
4.0
 None Remote Low Single system Partial None None
mod_scorm in Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3 mishandles availability dates, which allows remote authenticated users to bypass intended access restrictions and read SCORM contents via unspecified vectors.
44 CVE-2015-5340 264 +Info 2016-02-22 2016-03-02
4.0
 None Remote Low Single system Partial None None
Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3 does not consider the moodle/badges:viewbadges capability, which allows remote authenticated users to obtain sensitive badge information via a request involving (1) badges/overview.php or (2) badges/view.php.
45 CVE-2015-5339 264 +Info 2016-02-22 2016-03-02
4.0
 None Remote Low Single system Partial None None
The core_enrol_get_enrolled_users web service in enrol/externallib.php in Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3 does not properly implement group-based access restrictions, which allows remote authenticated users to obtain sensitive course-participant information via a web-service request.
46 CVE-2015-5338 352 CSRF 2016-02-22 2016-03-02
6.8
 None Remote Medium Not required Partial Partial Partial
Multiple cross-site request forgery (CSRF) vulnerabilities in the lesson module in Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3 allow remote attackers to hijack the authentication of arbitrary users for requests to (1) mod/lesson/mediafile.php or (2) mod/lesson/view.php.
47 CVE-2015-5337 79 XSS 2016-02-22 2016-03-02
4.3
 None Remote Medium Not required None Partial None
Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3 does not properly restrict the availability of Flowplayer, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted .swf file.
48 CVE-2015-5336 79 XSS 2016-02-22 2016-03-02
3.5
 None Remote Medium Single system None Partial None
Multiple cross-site scripting (XSS) vulnerabilities in the survey module in Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3 allow remote authenticated users to inject arbitrary web script or HTML by leveraging the student role and entering a crafted survey answer.
49 CVE-2015-5335 352 CSRF 2016-02-22 2016-03-02
4.3
 None Remote Medium Not required Partial None None
Cross-site request forgery (CSRF) vulnerability in admin/registration/register.php in Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3 allows remote attackers to hijack the authentication of administrators for requests that send statistics to an arbitrary hub URL.
50 CVE-2015-5332 399 DoS 2016-02-22 2016-03-02
7.1
 None Remote Medium Not required None None Complete
Atto in Moodle 2.8.x before 2.8.9 and 2.9.x before 2.9.3 allows remote attackers to cause a denial of service (disk consumption) by leveraging the guest role and entering drafts with the editor-autosave feature.
Total number of vulnerabilities : 343   Page : 1 (This Page)2 3 4 5 6 7
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.