CVE-2010-2231

EPSS 1.0%

Cross-site request forgery (CSRF) vulnerability in report/overview/report.php in the quiz module in Moodle before 1.8.13 and 1.9.x before 1.9.9 allows remote attackers to hijack the authentication of arbitrary users for requests that delete quiz attempts via the attemptid parameter.

Affected products

n/a · n/a

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

http://cvs.moodle.org/moodle/mod/quiz/report/overview/report.php?r1=1.98.2.50&r2=1.98.2.51 http://docs.moodle.org/en/Moodle_1.8.13_release_notes http://docs.moodle.org/en/Moodle_1.9.9_release_notes http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043285.html http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043291.html http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043340.html http://lists.opensuse.org/opensuse-security-announce/2010-08/msg00001.html http://moodle.org/mod/forum/discuss.php?d=152369 https://bugzilla.redhat.com/show_bug.cgi?id=605809 http://secunia.com/advisories/40248 http://secunia.com/advisories/40352 http://tracker.moodle.org/browse/MDL-21688