VulnerabilityModified
CVE-2010-2231
Cross-site request forgery (CSRF) vulnerability in report/overview/report.php in the quiz module in Moodle before 1.8.13 and 1.9.x before 1.9.9 allows remote attackers to hijack the authentication of arbitrary users for requests that delete quiz…
MEDIUM 6.8EPSS 0.98%
Does this matter?
Lower severity and a low EPSS score (0.98%). Track it; it rarely justifies an emergency change on its own.
Description
Cross-site request forgery (CSRF) vulnerability in report/overview/report.php in the quiz module in Moodle before 1.8.13 and 1.9.x before 1.9.9 allows remote attackers to hijack the authentication of arbitrary users for requests that delete quiz attempts via the attemptid parameter.
- CVSS 2.0
- 6.8 MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
- EPSS
- 0.98% probability · 60th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-352
- Affected
- moodle/moodle
- Source
- secalert@redhat.com
References
- http://cvs.moodle.org/moodle/mod/quiz/report/overview/report.php?r1=1.98.2.50&r2=1.98.2.51Patch
- http://docs.moodle.org/en/Moodle_1.8.13_release_notes
- http://docs.moodle.org/en/Moodle_1.9.9_release_notes
- http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043285.html
- http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043291.html
- http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043340.html
- http://lists.opensuse.org/opensuse-security-announce/2010-08/msg00001.html
- http://moodle.org/mod/forum/discuss.php?d=152369
- http://secunia.com/advisories/40248Vendor Advisory
- http://secunia.com/advisories/40352Vendor Advisory
- http://tracker.moodle.org/browse/MDL-21688
- http://www.openwall.com/lists/oss-security/2010/06/21/2
- http://www.vupen.com/english/advisories/2010/1530Patch, Vendor Advisory
- http://www.vupen.com/english/advisories/2010/1571Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=605809
- http://cvs.moodle.org/moodle/mod/quiz/report/overview/report.php?r1=1.98.2.50&r2=1.98.2.51Patch
- http://docs.moodle.org/en/Moodle_1.8.13_release_notes
- http://docs.moodle.org/en/Moodle_1.9.9_release_notes
- http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043285.html
- http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043291.html
- http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043340.html
- http://lists.opensuse.org/opensuse-security-announce/2010-08/msg00001.html
- http://moodle.org/mod/forum/discuss.php?d=152369
- http://secunia.com/advisories/40248Vendor Advisory
- http://secunia.com/advisories/40352Vendor Advisory
- http://tracker.moodle.org/browse/MDL-21688
- http://www.openwall.com/lists/oss-security/2010/06/21/2
- http://www.vupen.com/english/advisories/2010/1530Patch, Vendor Advisory
- http://www.vupen.com/english/advisories/2010/1571Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=605809
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.