Moodle 2.x and 3.x
9 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2017-7491 | Moodle 2.x and 3.x | In Moodle 2.x and 3.x, a CSRF attack is possible that allows attackers to change the "number of courses displayed in the course overview blo | MEDIUM 4.3 | 0.5 % | ||
| CVE-2017-7490 | Moodle 2.x and 3.x | In Moodle 2.x and 3.x, searching of arbitrary blogs is possible because a capability check is missing. | MEDIUM 5.3 | 1.0 % | ||
| CVE-2017-7489 | Moodle 2.x and 3.x | In Moodle 2.x and 3.x, remote authenticated users can take ownership of arbitrary blogs by editing an external blog link. | MEDIUM 6.3 | 1.2 % | ||
| CVE-2017-2641 | Moodle 2.x and 3.x | In Moodle 2.x and 3.x, SQL injection can occur via user preferences. | CRITICAL 9.8 | 15 % | ||
| CVE-2017-2576 | Moodle 2.x and 3.x | In Moodle 2.x and 3.x, there is incorrect sanitization of attributes in forums. | MEDIUM 5.3 | 1.0 % | ||
| CVE-2016-8644 | Moodle 2.x and 3.x | In Moodle 2.x and 3.x, the capability to view course notes is checked in the wrong context. | MEDIUM 5.3 | 1.2 % | ||
| CVE-2016-8643 | Moodle 2.x and 3.x | In Moodle 2.x and 3.x, non-admin site managers may accidentally edit admins via web services. | MEDIUM 4.3 | 0.7 % | ||
| CVE-2016-8642 | Moodle 2.x and 3.x | In Moodle 2.x and 3.x, the question engine allows access to files that should not be available. | MEDIUM 5.3 | 1.2 % | ||
| CVE-2016-7038 | Moodle 2.x and 3.x | In Moodle 2.x and 3.x, web service tokens are not invalidated when the user password is changed or forced to be changed. | HIGH 7.3 | 1.0 % |