# |
CVE ID
|
CWE ID
|
# of Exploits
|
Vulnerability Type(s)
|
Publish Date
|
Update Date
|
Score
|
Gained Access Level
|
Access
|
Complexity
|
Authentication
|
Conf.
|
Integ.
|
Avail.
|
1 |
CVE-2018-1045 |
79 |
|
XSS |
2018-01-22 |
2018-02-05 |
3.5 |
None |
Remote |
Medium |
Single system |
None |
Partial |
None |
In Moodle 3.x, there is XSS via a calendar event name. |
2 |
CVE-2018-1044 |
200 |
|
+Info |
2018-01-22 |
2018-02-05 |
4.0 |
None |
Remote |
Low |
Single system |
Partial |
None |
None |
In Moodle 3.x, quiz web services allow students to see quiz results when it is prohibited in the settings. |
3 |
CVE-2018-1043 |
254 |
|
Bypass |
2018-01-22 |
2018-02-05 |
4.0 |
None |
Remote |
Low |
Single system |
None |
Partial |
None |
In Moodle 3.x, the setting for blocked hosts list can be bypassed with multiple A record hostnames. |
4 |
CVE-2018-1042 |
918 |
|
|
2018-01-22 |
2018-02-05 |
4.0 |
None |
Remote |
Low |
Single system |
Partial |
None |
None |
Moodle 3.x has Server Side Request Forgery in the filepicker. |
5 |
CVE-2017-15110 |
200 |
|
+Info |
2017-11-20 |
2017-12-06 |
4.0 |
None |
Remote |
Low |
Single system |
Partial |
None |
None |
In Moodle 3.x, students can find out email addresses of other students in the same course. Using search on the Participants page, students could search email addresses of all participants regardless of email visibility. This allows enumerating and guessing emails of other students. |
6 |
CVE-2017-12157 |
200 |
|
+Info |
2017-09-18 |
2017-09-28 |
4.0 |
None |
Remote |
Low |
Single system |
Partial |
None |
None |
In Moodle 3.x, various course reports allow teachers to view details about users in the groups they can't access. |
7 |
CVE-2017-12156 |
79 |
|
XSS |
2017-09-18 |
2017-09-21 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
Partial |
None |
Moodle 3.x has XSS in the contact form on the "non-respondents" page in non-anonymous feedback. |
8 |
CVE-2017-7532 |
284 |
|
|
2017-07-17 |
2017-07-19 |
4.0 |
None |
Remote |
Low |
Single system |
None |
Partial |
None |
In Moodle 3.x, course creators are able to change system default settings for courses. |
9 |
CVE-2017-7531 |
200 |
|
+Info |
2017-07-17 |
2017-07-19 |
4.0 |
None |
Remote |
Low |
Single system |
Partial |
None |
None |
In Moodle 3.3, the course overview block reveals activities in hidden courses. |
10 |
CVE-2017-7491 |
352 |
|
CSRF |
2017-05-15 |
2017-05-23 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
Partial |
None |
In Moodle 2.x and 3.x, a CSRF attack is possible that allows attackers to change the "number of courses displayed in the course overview block" configuration setting. |
11 |
CVE-2017-7490 |
264 |
|
|
2017-05-15 |
2017-05-23 |
5.0 |
None |
Remote |
Low |
Not required |
Partial |
None |
None |
In Moodle 2.x and 3.x, searching of arbitrary blogs is possible because a capability check is missing. |
12 |
CVE-2017-7489 |
264 |
|
|
2017-05-15 |
2017-05-23 |
6.5 |
None |
Remote |
Low |
Single system |
Partial |
Partial |
Partial |
In Moodle 2.x and 3.x, remote authenticated users can take ownership of arbitrary blogs by editing an external blog link. |
13 |
CVE-2017-7298 |
79 |
|
XSS |
2017-03-29 |
2017-03-30 |
3.5 |
None |
Remote |
Medium |
Single system |
None |
Partial |
None |
In Moodle 3.2.2+, there is XSS in the Course summary filter of the "Add a new course" page, as demonstrated by a crafted attribute of an SVG element. |
14 |
CVE-2017-2645 |
79 |
|
XSS |
2017-03-26 |
2017-07-11 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
Partial |
None |
In Moodle 3.x, XSS can occur via attachments to evidence of prior learning. |
15 |
CVE-2017-2644 |
79 |
|
XSS |
2017-03-26 |
2017-07-11 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
Partial |
None |
In Moodle 3.x, XSS can occur via evidence of prior learning. |
16 |
CVE-2017-2643 |
200 |
|
+Info |
2017-03-26 |
2017-07-11 |
5.0 |
None |
Remote |
Low |
Not required |
Partial |
None |
None |
In Moodle 3.2.x, global search displays user names for unauthenticated users. |
17 |
CVE-2017-2642 |
200 |
|
+Info |
2017-07-17 |
2017-07-19 |
4.0 |
None |
Remote |
Low |
Single system |
Partial |
None |
None |
Moodle 3.x has user fullname disclosure on the user preferences page. |
18 |
CVE-2017-2641 |
89 |
|
Sql |
2017-03-26 |
2017-08-15 |
7.5 |
None |
Remote |
Low |
Not required |
Partial |
Partial |
Partial |
In Moodle 2.x and 3.x, SQL injection can occur via user preferences. |
19 |
CVE-2017-2578 |
79 |
|
XSS |
2017-01-20 |
2017-01-25 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
Partial |
None |
In Moodle 3.x, there is XSS in the assignment submission page. |
20 |
CVE-2017-2576 |
20 |
|
|
2017-01-20 |
2017-01-25 |
5.0 |
None |
Remote |
Low |
Not required |
None |
Partial |
None |
In Moodle 2.x and 3.x, there is incorrect sanitization of attributes in forums. |
21 |
CVE-2016-9188 |
79 |
|
XSS |
2016-11-04 |
2016-11-29 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
Partial |
None |
Cross-site scripting (XSS) vulnerabilities in Moodle CMS on or before 3.1.2 allow remote attackers to inject arbitrary web script or HTML via the s_additionalhtmlhead, s_additionalhtmltopofbody, and s_additionalhtmlfooter parameters. |
22 |
CVE-2016-9187 |
434 |
|
Exec Code |
2016-11-04 |
2016-11-29 |
6.5 |
None |
Remote |
Low |
Single system |
Partial |
Partial |
Partial |
Unrestricted file upload vulnerability in the double extension support in the "image" module in Moodle 3.1.2 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, and then accessing it via unspecified vectors. |
23 |
CVE-2016-9186 |
434 |
|
Exec Code |
2016-11-04 |
2016-11-29 |
6.5 |
None |
Remote |
Low |
Single system |
Partial |
Partial |
Partial |
Unrestricted file upload vulnerability in the "legacy course files" and "file manager" modules in Moodle 3.1.2 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, and then accessing it via unspecified vectors. |
24 |
CVE-2016-8644 |
264 |
|
|
2017-01-20 |
2017-01-25 |
5.0 |
None |
Remote |
Low |
Not required |
Partial |
None |
None |
In Moodle 2.x and 3.x, the capability to view course notes is checked in the wrong context. |
25 |
CVE-2016-8643 |
284 |
|
|
2017-01-20 |
2017-01-25 |
4.0 |
None |
Remote |
Low |
Single system |
None |
Partial |
None |
In Moodle 2.x and 3.x, non-admin site managers may accidentally edit admins via web services. |
26 |
CVE-2016-8642 |
284 |
|
|
2017-01-20 |
2017-01-25 |
5.0 |
None |
Remote |
Low |
Not required |
Partial |
None |
None |
In Moodle 2.x and 3.x, the question engine allows access to files that should not be available. |
27 |
CVE-2016-7919 |
89 |
|
Sql +Info |
2016-10-28 |
2016-12-02 |
5.0 |
None |
Remote |
Low |
Not required |
Partial |
None |
None |
** DISPUTED ** Moodle 3.1.2 allows remote attackers to obtain sensitive information via unspecified vectors, related to a "SQL Injection" issue affecting the Administration panel function in the installation process component. NOTE: the vendor disputes the relevance of this report, noting that "the person who is installing Moodle must know database access credentials and they can access the database directly; there is no need for them to create a SQL injection in one of the installation dialogue fields." |
28 |
CVE-2016-7038 |
640 |
|
|
2017-01-20 |
2017-01-25 |
5.0 |
None |
Remote |
Low |
Not required |
Partial |
None |
None |
In Moodle 2.x and 3.x, web service tokens are not invalidated when the user password is changed or forced to be changed. |
29 |
CVE-2016-5014 |
200 |
|
+Info |
2017-01-20 |
2017-01-25 |
5.8 |
None |
Remote |
Medium |
Not required |
Partial |
Partial |
None |
In Moodle 2.x and 3.x, an unenrolled user still receives event monitor notifications even though they can no longer access the course. |
30 |
CVE-2016-5013 |
74 |
|
|
2017-01-20 |
2017-01-25 |
5.8 |
None |
Remote |
Medium |
Not required |
Partial |
Partial |
None |
In Moodle 2.x and 3.x, text injection can occur in email headers, potentially leading to outbound spam. |
31 |
CVE-2016-5012 |
200 |
|
+Info |
2017-01-20 |
2017-01-25 |
5.0 |
None |
Remote |
Low |
Not required |
Partial |
None |
None |
In Moodle 3.x, glossary search displays entries without checking user permissions to view them. |
32 |
CVE-2016-3734 |
352 |
|
CSRF |
2017-04-20 |
2017-04-27 |
6.8 |
None |
Remote |
Medium |
Not required |
Partial |
Partial |
Partial |
Cross-site request forgery (CSRF) vulnerability in markposts.php in Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, 2.8 through 2.8.11, 2.7 through 2.7.13 and earlier allows remote attackers to hijack the authentication of users for requests that marks forum posts as read. |
33 |
CVE-2016-3733 |
284 |
|
|
2017-04-20 |
2017-04-28 |
4.0 |
None |
Remote |
Low |
Single system |
None |
Partial |
None |
The "restore teacher" feature in Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, 2.8 through 2.8.11, 2.7 through 2.7.13, and earlier allows remote authenticated users to overwrite the course idnumber. |
34 |
CVE-2016-3732 |
200 |
|
+Info |
2017-04-20 |
2017-04-27 |
4.0 |
None |
Remote |
Low |
Single system |
Partial |
None |
None |
The capability check to access other badges in Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, 2.8 through 2.8.11, 2.7 through 2.7.13, and earlier allows remote authenticated users to read the badges of other users. |
35 |
CVE-2016-3731 |
200 |
|
+Info |
2017-04-20 |
2017-04-27 |
5.0 |
None |
Remote |
Low |
Not required |
Partial |
None |
None |
Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, and 2.8 through 2.8.11 allows remote attackers to obtain the names of hidden forums and forum discussions. |
36 |
CVE-2016-3729 |
284 |
|
|
2017-04-20 |
2017-04-27 |
4.0 |
None |
Remote |
Low |
Single system |
None |
Partial |
None |
The user editing form in Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, 2.8 through 2.8.11, 2.7 through 2.7.13, and earlier allows remote authenticated users to edit profile fields locked by the administrator. |
37 |
CVE-2016-2190 |
264 |
|
+Info |
2016-05-22 |
2017-09-06 |
5.0 |
None |
Remote |
Low |
Not required |
Partial |
None |
None |
Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 does not properly restrict links, which allows remote attackers to obtain sensitive URL information by reading a Referer log. |
38 |
CVE-2016-2159 |
284 |
|
Bypass |
2016-05-22 |
2017-09-06 |
4.0 |
None |
Remote |
Low |
Single system |
None |
Partial |
None |
The save_submission function in mod/assign/externallib.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 allows remote authenticated users to bypass intended due-date restrictions by leveraging the student role for a web-service request. |
39 |
CVE-2016-2158 |
200 |
|
+Info |
2016-05-22 |
2017-09-06 |
4.0 |
None |
Remote |
Low |
Single system |
Partial |
None |
None |
lib/ajax/getnavbranch.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3, when the forcelogin feature is enabled, allows remote attackers to obtain sensitive category-detail information from the navigation branch by leveraging the guest role for an Ajax request. |
40 |
CVE-2016-2157 |
352 |
|
CSRF |
2016-05-22 |
2017-09-06 |
6.8 |
None |
Remote |
Medium |
Not required |
Partial |
Partial |
Partial |
Cross-site request forgery (CSRF) vulnerability in mod/assign/adminmanageplugins.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 allows remote attackers to hijack the authentication of administrators for requests that manage Assignment plugins. |
41 |
CVE-2016-2156 |
200 |
|
+Info |
2016-05-22 |
2017-09-06 |
4.0 |
None |
Remote |
Low |
Single system |
Partial |
None |
None |
calendar/externallib.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 provides calendar-event data without considering whether an activity is hidden, which allows remote authenticated users to obtain sensitive information via a web-service request. |
42 |
CVE-2016-2155 |
264 |
|
|
2016-05-22 |
2017-09-06 |
4.0 |
None |
Remote |
Low |
Single system |
None |
Partial |
None |
The grade-reporting feature in Singleview (aka Single View) in Moodle 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 does not consider the moodle/grade:manage capability, which allows remote authenticated users to modify "Exclude grade" settings by leveraging the Non-Editing Instructor role. |
43 |
CVE-2016-2154 |
200 |
|
+Info |
2016-05-22 |
2017-09-06 |
4.0 |
None |
Remote |
Low |
Single system |
Partial |
None |
None |
admin/tool/monitor/lib.php in Event Monitor in Moodle 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 does not consider the moodle/course:viewhiddencourses capability, which allows remote authenticated users to discover hidden course names by subscribing to a rule. |
44 |
CVE-2016-2153 |
79 |
|
XSS |
2016-05-22 |
2017-09-06 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
Partial |
None |
Cross-site scripting (XSS) vulnerability in the advanced-search feature in mod_data in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 allows remote attackers to inject arbitrary web script or HTML via a crafted field in a URL, as demonstrated by a search form field. |
45 |
CVE-2016-2152 |
79 |
|
XSS |
2016-05-22 |
2017-09-06 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
Partial |
None |
Multiple cross-site scripting (XSS) vulnerabilities in auth/db/auth.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 allow remote attackers to inject arbitrary web script or HTML via an external DB profile field. |
46 |
CVE-2016-2151 |
200 |
|
+Info |
2016-05-22 |
2017-09-06 |
4.0 |
None |
Remote |
Low |
Single system |
Partial |
None |
None |
user/index.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 grants excessive authorization on the basis of the moodle/course:viewhiddenuserfields capability, which allows remote authenticated users to discover student e-mail addresses by leveraging the teacher role and reading a Participants list. |
47 |
CVE-2016-0725 |
79 |
|
XSS |
2016-02-22 |
2017-09-09 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
Partial |
None |
Cross-site scripting (XSS) vulnerability in the search_pagination function in course/classes/management_renderer.php in Moodle 2.8.x before 2.8.10, 2.9.x before 2.9.4, and 3.0.x before 3.0.2 allows remote attackers to inject arbitrary web script or HTML via a crafted search string. |
48 |
CVE-2016-0724 |
264 |
|
+Info |
2016-02-22 |
2017-09-09 |
4.0 |
None |
Remote |
Low |
Single system |
Partial |
None |
None |
The (1) core_enrol_get_course_enrolment_methods and (2) enrol_self_get_instance_info web services in Moodle through 2.6.11, 2.7.x before 2.7.12, 2.8.x before 2.8.10, 2.9.x before 2.9.4, and 3.0.x before 3.0.2 do not consider the moodle/course:viewhiddencourses capability, which allows remote authenticated users to obtain sensitive information via a web-service request. |
49 |
CVE-2015-5342 |
264 |
|
Bypass |
2016-02-22 |
2016-03-02 |
4.0 |
None |
Remote |
Low |
Single system |
None |
Partial |
None |
The choice module in Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3 allows remote authenticated users to bypass intended access restrictions by visiting a URL to add or delete responses in the closed state. |
50 |
CVE-2015-5341 |
264 |
|
Bypass |
2016-02-22 |
2016-03-02 |
4.0 |
None |
Remote |
Low |
Single system |
Partial |
None |
None |
mod_scorm in Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3 mishandles availability dates, which allows remote authenticated users to bypass intended access restrictions and read SCORM contents via unspecified vectors. |