Moodle is prone to multiple vulnerabilities, including: - multiple cross-site scripting issues - a security-bypass issue - an information-disclosure issue - multiple SQL-injection issues - an HTML-injection issue - a session-fixation issue Attackers can exploit these issues to bypass certain security restrictions, obtain sensitive information, perform unauthorized actions, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. Other attacks may also be possible. These issues affect versions prior to Moodle 1.9.8 and 1.8.12.
Updates are available. Please see the references for more information.
- DD-WRT '/Info.live.htm' Multiple Information Disclosure Vulnerabilities
- Nagios XI 'users.php' Multiple Cross-Site Scripting Vulnerabilities
- PmWiki Table Feature 'width' Parameter Cross-site scripting vulnerability
- IBM WebSphere Application Server SIP Logging Information Disclosure Vulnerability
- Packeteer Web Management Interface Login