Advisories ยป MGASA-2015-0032

Updated moodle package fixes security vulnerabilities

Publication date: 20 Jan 2015
Type: security
Affected Mageia releases : 4
CVE: CVE-2015-0211 , CVE-2015-0212 , CVE-2015-0213 , CVE-2015-0214 , CVE-2015-0215 , CVE-2015-0217 , CVE-2015-0218


Updated moodle package fixes security vulnerabilities:

In Moodle before 2.6.7, absence of a capability check in AJAX backend script
in the LTI module could allow any enrolled user to search the list of
registered tools (CVE-2015-0211).

In Moodle before 2.6.7, the course summary on course request pending approval
page was displayed to the manager unescaped and could be used for XSS attack

In Moodle before 2.6.7, two files in the Glossary module lacked a session key
check potentially allowing cross-site request forgery (CVE-2015-0213).

In Moodle before 2.6.7, through web-services it was possible to access
messaging-related functions such as people search even if messaging is
disabled on the site (CVE-2015-0214).

In Moodle before 2.6.7, through web-services it was possible to get
information about calendar events which user did not have enough permissions
to see (CVE-2015-0215).

In Moodle before 2.6.7, non-optimal regular expression in the multimedia
filter could be exploited to create extra server load or make particular page
unavailable, resulting in a denial of service (CVE-2015-0217).

In Moodle before 2.6.7, it was possible to forge a request to logout users
even when not authenticated through Shibboleth (CVE-2015-0218).