CVE-2011-4133

Cross-site request forgery (CSRF) vulnerability in Moodle 1.9.x before 1.9.11 allows remote attackers to hijack the authentication of unspecified victims for requests that modify an RSS feed in an RSS block.

CVSS v2.0 6.8 MEDIUM

6.8^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability : 8.6 / Impact : 6.4

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://git.moodle.org/gw?p=moodle.git%3Ba=commit%3Bh=8f031d5431c1204197b1482fd6c63bc87a19a476
http://moodle.org/mod/forum/discuss.php?d=170002	Vendor Advisory
http://openwall.com/lists/oss-security/2011/11/14/1

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:moodle:moodle:1.9.1:::::::*
	cpe:2.3:a:moodle:moodle:1.9.2:::::::*
	cpe:2.3:a:moodle:moodle:1.9.3:::::::*
	cpe:2.3:a:moodle:moodle:1.9.4:::::::*
	cpe:2.3:a:moodle:moodle:1.9.5:::::::*
	cpe:2.3:a:moodle:moodle:1.9.6:::::::*
	cpe:2.3:a:moodle:moodle:1.9.7:::::::*
	cpe:2.3:a:moodle:moodle:1.9.8:::::::*
	cpe:2.3:a:moodle:moodle:1.9.9:::::::*
	cpe:2.3:a:moodle:moodle:1.9.10:::::::*

History

No history.

Information

Published : 2012-07-16 10:28

Updated : 2023-11-07 02:09

NVD link : CVE-2011-4133

Mitre link : CVE-2011-4133

CVE.ORG link : CVE-2011-4133

JSON object : View

Products Affected

moodle

moodle

CWE

CWE-352

Cross-Site Request Forgery (CSRF)

{"id": "CVE-2011-4133", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}]}, "published": "2012-07-16T10:28:36.207", "references": [{"url": "http://git.moodle.org/gw?p=moodle.git%3Ba=commit%3Bh=8f031d5431c1204197b1482fd6c63bc87a19a476", "source": "secalert@redhat.com"}, {"url": "http://moodle.org/mod/forum/discuss.php?d=170002", "tags": ["Vendor Advisory"], "source": "secalert@redhat.com"}, {"url": "http://openwall.com/lists/oss-security/2011/11/14/1", "source": "secalert@redhat.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-352"}]}], "descriptions": [{"lang": "en", "value": "Cross-site request forgery (CSRF) vulnerability in Moodle 1.9.x before 1.9.11 allows remote attackers to hijack the authentication of unspecified victims for requests that modify an RSS feed in an RSS block."}, {"lang": "es", "value": "Una vulnerabilidad de falsificaci\u00f3n de peticiones en sitios cruzados (CSRF) en Moodle v1.9.x antes de v1.9.11 permite a atacantes remotos secuestrar la autenticaci\u00f3n de v\u00edctimas aleatorias en solicitudes que modifican un feed RSS en un bloque de RSS.\r\n"}], "lastModified": "2023-11-07T02:09:15.990", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:moodle:moodle:1.9.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "24F2602B-8ED3-4026-A9A4-31BE8BDC7724"}, {"criteria": "cpe:2.3:a:moodle:moodle:1.9.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D7F24649-B67F-4809-9F54-7B623AEF5A4A"}, {"criteria": "cpe:2.3:a:moodle:moodle:1.9.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6B81655E-C3B5-4115-A4C4-B7AC2FCDAB7F"}, {"criteria": "cpe:2.3:a:moodle:moodle:1.9.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "ED9C3840-66BE-47EC-9F0C-E9D2171FF0B2"}, {"criteria": "cpe:2.3:a:moodle:moodle:1.9.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DBD062EB-1B1F-4DC8-A4F9-C2EC7D401E9D"}, {"criteria": "cpe:2.3:a:moodle:moodle:1.9.6:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "291F73E9-1059-4E7F-860F-0DF2A35AA456"}, {"criteria": "cpe:2.3:a:moodle:moodle:1.9.7:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0EB5859E-0996-46B5-BB44-34BD6EACBCF5"}, {"criteria": "cpe:2.3:a:moodle:moodle:1.9.8:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F87F6707-99AB-478A-909D-1D87298D5514"}, {"criteria": "cpe:2.3:a:moodle:moodle:1.9.9:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4BCE8B26-58BB-471C-B291-E6AE22B96C5B"}, {"criteria": "cpe:2.3:a:moodle:moodle:1.9.10:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "768CE5AF-955B-4148-998A-A46BBDBA618B"}], "operator": "OR"}]}], "sourceIdentifier": "secalert@redhat.com"}