CVE-2010-2231

Cross-site request forgery (CSRF) vulnerability in report/overview/report.php in the quiz module in Moodle before 1.8.13 and 1.9.x before 1.9.9 allows remote attackers to hijack the authentication of arbitrary users for requests that delete quiz attempts via the attemptid parameter.

Published Bysecalert@redhat.com

Published DateJun 28, 2010, 17:30

Weakness Type (CWE):CWE-352

CVSS Metrics

Base Score

6.8

Vector String

AV:N/AC:M/Au:N/C:P/I:P/A:P

Base Severity

Version

2.0

Attack Vector (AV)

Attack Complexity (AC)

Privileges Required (PR)

User Interaction (UI)

Scope (S)

Confidentiality (C)

PARTIAL

Integrity (I)

PARTIAL

Availability (A)

PARTIAL

References

http://cvs.moodle.org/moodle/mod/quiz/report/overview/report.php?r1=1.98.2.50&r2=1.98.2.51
http://docs.moodle.org/en/Moodle_1.8.13_release_notes
http://docs.moodle.org/en/Moodle_1.9.9_release_notes
http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043285.html
http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043291.html
http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043340.html
http://lists.opensuse.org/opensuse-security-announce/2010-08/msg00001.html
http://moodle.org/mod/forum/discuss.php?d=152369
http://secunia.com/advisories/40248
http://secunia.com/advisories/40352
http://tracker.moodle.org/browse/MDL-21688
http://www.openwall.com/lists/oss-security/2010/06/21/2
http://www.vupen.com/english/advisories/2010/1530
http://www.vupen.com/english/advisories/2010/1571
https://bugzilla.redhat.com/show_bug.cgi?id=605809

Weakness Type (CWE):CWE-352

CVSS Metrics

Base Score

6.8

Vector String

AV:N/AC:M/Au:N/C:P/I:P/A:P

Base Severity

Version

2.0

Attack Vector (AV)

Attack Complexity (AC)

Privileges Required (PR)

User Interaction (UI)

Scope (S)

Confidentiality (C)

PARTIAL

Integrity (I)

PARTIAL

Availability (A)

PARTIAL