OSVDB ID: 82065

Title: Moodle Read-only Mode Bypass Database Activity Entry Manipulation

Info

Disclosure
May 22, 2012

Discovery
Unknown

Dates

Exploit
Unknown

Solution
May 21, 2012

Description

 Moodle contains a flaw that is triggered by an error when handling access permissions, which may allow an attacker to bypass read-only mode and manipulate arbitrary activity entries.

Classification

 Location: Remote / Network Access
Attack Type: Input Manipulation
Impact: Loss of Integrity
Solution: Upgrade
Exploit: Exploit Private
Disclosure: Vendor Verified, Coordinated Disclosure
OSVDB: Web Related

Solution

 Upgrade to version 1.9.18, 2.0.9, 2.1.6, or 2.2.3 or higher, as they have been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.

Products

Moodle Trust

Moodle

 2.2.0
2.2
2.2.0-rc1
2.2.0 beta
2.2.1
2.1.0
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.0.4
2.0.3
2.0.1
2.0.7
2.0.6
2.0.5
2.0.0-rc1
2.0.0-rc2
2.0.0
2.0.2
2.0.8

References

Credit

Unknown or Incomplete


Direct URL: http://osvdb.org/82065