CVE-2014-0010: CSRF
First published: Mon Jan 20 2014(Updated: )
Multiple cross-site request forgery (CSRF) vulnerabilities in user/profile/index.php in Moodle through 2.2.11, 2.3.x before 2.3.11, 2.4.x before 2.4.8, 2.5.x before 2.5.4, and 2.6.x before 2.6.1 allow remote attackers to hijack the authentication of administrators for requests that delete (1) categories or (2) fields.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Moodle | =2.4.0 | |
| Moodle | =2.4.1 | |
| Moodle | =2.4.2 | |
| Moodle | =2.4.3 | |
| Moodle | =2.4.4 | |
| Moodle | =2.4.5 | |
| Moodle | =2.4.6 | |
| Moodle | =2.4.7 | |
| Fedora | =19 | |
| Fedora | =20 | |
| Moodle | =2.6.0 | |
| Moodle | =2.5.0 | |
| Moodle | =2.5.1 | |
| Moodle | =2.5.2 | |
| Moodle | =2.5.3 | |
| Moodle | <=2.2.11 | |
| Moodle | =2.0.0 | |
| Moodle | =2.0.1 | |
| Moodle | =2.0.2 | |
| Moodle | =2.0.3 | |
| Moodle | =2.0.4 | |
| Moodle | =2.0.5 | |
| Moodle | =2.0.6 | |
| Moodle | =2.0.7 | |
| Moodle | =2.0.8 | |
| Moodle | =2.0.9 | |
| Moodle | =2.1.0 | |
| Moodle | =2.1.1 | |
| Moodle | =2.1.2 | |
| Moodle | =2.1.3 | |
| Moodle | =2.1.4 | |
| Moodle | =2.1.5 | |
| Moodle | =2.1.6 | |
| Moodle | =2.1.7 | |
| Moodle | =2.1.8 | |
| Moodle | =2.1.9 | |
| Moodle | =2.1.10 | |
| Moodle | =2.2.0 | |
| Moodle | =2.2.1 | |
| Moodle | =2.2.2 | |
| Moodle | =2.2.3 | |
| Moodle | =2.2.4 | |
| Moodle | =2.2.5 | |
| Moodle | =2.2.6 | |
| Moodle | =2.2.7 | |
| Moodle | =2.2.8 | |
| Moodle | =2.2.9 | |
| Moodle | =2.2.10 | |
| Moodle | =2.3.0 | |
| Moodle | =2.3.1 | |
| Moodle | =2.3.2 | |
| Moodle | =2.3.3 | |
| Moodle | =2.3.4 | |
| Moodle | =2.3.5 | |
| Moodle | =2.3.6 | |
| Moodle | =2.3.7 | |
| Moodle | =2.3.8 | |
| Moodle | =2.3.9 | |
| Moodle | =2.3.10 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-42883
- http://lists.fedoraproject.org/pipermail/package-announce/2014-January/127510.html
- http://lists.fedoraproject.org/pipermail/package-announce/2014-January/127533.html
- http://openwall.com/lists/oss-security/2014/01/20/1
- http://osvdb.org/102261
- http://www.securitytracker.com/id/1029649
- https://moodle.org/mod/forum/discuss.php?d=252416
Frequently Asked Questions
What is the severity of CVE-2014-0010?
CVE-2014-0010 has a medium severity level as it allows remote attackers to hijack the authentication of administrators.
How do I fix CVE-2014-0010?
To fix CVE-2014-0010, upgrade Moodle to the latest version that addresses this vulnerability.
What versions are affected by CVE-2014-0010?
CVE-2014-0010 affects Moodle versions prior to 2.6.1, including 2.2.11, 2.3.x before 2.3.11, 2.4.x before 2.4.8, 2.5.x before 2.5.4, and others.
What type of vulnerability is CVE-2014-0010?
CVE-2014-0010 is classified as a cross-site request forgery (CSRF) vulnerability.
Can CVE-2014-0010 be exploited remotely?
Yes, CVE-2014-0010 can be exploited remotely, allowing attackers to perform unauthorized actions on behalf of an administrator.
- agent/type
- agent/remedy
- collector/mitre-cve
- source/MITRE
- agent/author
- agent/severity
- agent/last-modified-date
- agent/references
- agent/first-publish-date
- agent/event
- agent/description
- agent/source
- agent/weakness
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/moodle
- canonical/moodle
- version/moodle/2.4.0
- version/moodle/2.4.1
- version/moodle/2.4.2
- version/moodle/2.4.3
- version/moodle/2.4.4
- version/moodle/2.4.5
- version/moodle/2.4.6
- version/moodle/2.4.7
- vendor/fedoraproject
- canonical/fedora
- version/fedora/19
- version/fedora/20
- version/moodle/2.6.0
- version/moodle/2.5.0
- version/moodle/2.5.1
- version/moodle/2.5.2
- version/moodle/2.5.3
- version/moodle/2.2.11
- version/moodle/2.0.0
- version/moodle/2.0.1
- version/moodle/2.0.2
- version/moodle/2.0.3
- version/moodle/2.0.4
- version/moodle/2.0.5
- version/moodle/2.0.6
- version/moodle/2.0.7
- version/moodle/2.0.8
- version/moodle/2.0.9
- version/moodle/2.1.0
- version/moodle/2.1.1
- version/moodle/2.1.2
- version/moodle/2.1.3
- version/moodle/2.1.4
- version/moodle/2.1.5
- version/moodle/2.1.6
- version/moodle/2.1.7
- version/moodle/2.1.8
- version/moodle/2.1.9
- version/moodle/2.1.10
- version/moodle/2.2.0
- version/moodle/2.2.1
- version/moodle/2.2.2
- version/moodle/2.2.3
- version/moodle/2.2.4
- version/moodle/2.2.5
- version/moodle/2.2.6
- version/moodle/2.2.7
- version/moodle/2.2.8
- version/moodle/2.2.9
- version/moodle/2.2.10
- version/moodle/2.3.0
- version/moodle/2.3.1
- version/moodle/2.3.2
- version/moodle/2.3.3
- version/moodle/2.3.4
- version/moodle/2.3.5
- version/moodle/2.3.6
- version/moodle/2.3.7
- version/moodle/2.3.8
- version/moodle/2.3.9
- version/moodle/2.3.10