CVE-2011-4298: Moodle vulnerable to Cross-Site Request Forgery
Moodle vulnerable to Cross-Site Request Forgery
Other sources
Multiple cross-site request forgery (CSRF) vulnerabilities in mod/wiki/ components in Moodle 2.0.x before 2.0.5 and 2.1.x before 2.1.2 allow remote attackers to hijack the authentication of arbitrary users for requests that modify wiki data.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 2.1.2 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 2.0.5
Event History
Frequently Asked Questions
What is the severity of CVE-2011-4298?
CVE-2011-4298 has a medium severity rating due to its potential to allow attackers to hijack user authentication.
How do I fix CVE-2011-4298?
To fix CVE-2011-4298, update your Moodle installation to version 2.0.5 or 2.1.2 or later.
Which versions of Moodle are affected by CVE-2011-4298?
CVE-2011-4298 affects Moodle versions prior to 2.0.5 and 2.1.2, including all 2.0.x and 2.1.x versions before these updates.
What kind of attacks can be executed through CVE-2011-4298?
CVE-2011-4298 allows attackers to perform cross-site request forgery (CSRF) attacks that can modify wiki data.
Is user data at risk with CVE-2011-4298?
Yes, user data is at risk as CVE-2011-4298 can lead to unauthorized modifications of wiki content by hijacking user sessions.