Moodle 2.x and 3.x
9 vulnérabilités publiées citent ce produit.
Tel que les CNA l’écrivent dans leurs fiches CVE (éditeur et produit) ; les versions sont les leurs.
| CVE | Versions vulnérables | Titre | Sévérité | Publiée | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2017-7491 | Moodle 2.x and 3.x | In Moodle 2.x and 3.x, a CSRF attack is possible that allows attackers to change the "number of courses displayed in the course overview blo | MEDIUM 4.3 | 0.5 % | ||
| CVE-2017-7490 | Moodle 2.x and 3.x | In Moodle 2.x and 3.x, searching of arbitrary blogs is possible because a capability check is missing. | MEDIUM 5.3 | 1.0 % | ||
| CVE-2017-7489 | Moodle 2.x and 3.x | In Moodle 2.x and 3.x, remote authenticated users can take ownership of arbitrary blogs by editing an external blog link. | MEDIUM 6.3 | 1.2 % | ||
| CVE-2017-2641 | Moodle 2.x and 3.x | In Moodle 2.x and 3.x, SQL injection can occur via user preferences. | CRITICAL 9.8 | 15 % | ||
| CVE-2017-2576 | Moodle 2.x and 3.x | In Moodle 2.x and 3.x, there is incorrect sanitization of attributes in forums. | MEDIUM 5.3 | 1.0 % | ||
| CVE-2016-8644 | Moodle 2.x and 3.x | In Moodle 2.x and 3.x, the capability to view course notes is checked in the wrong context. | MEDIUM 5.3 | 1.2 % | ||
| CVE-2016-8643 | Moodle 2.x and 3.x | In Moodle 2.x and 3.x, non-admin site managers may accidentally edit admins via web services. | MEDIUM 4.3 | 0.7 % | ||
| CVE-2016-8642 | Moodle 2.x and 3.x | In Moodle 2.x and 3.x, the question engine allows access to files that should not be available. | MEDIUM 5.3 | 1.2 % | ||
| CVE-2016-7038 | Moodle 2.x and 3.x | In Moodle 2.x and 3.x, web service tokens are not invalidated when the user password is changed or forced to be changed. | HIGH 7.3 | 1.0 % |