Marina Glancy reports :

- MSA-16-0013: Users are able to change profile fields that were locked by the administrator.

- MSA-16-0015: Information disclosure of hidden forum names and sub-names.

- MSA-16-0016: User can view badges of other users without proper permissions.

- MSA-16-0017: Course idnumber not protected from teacher restore.

- MSA-16-0018: CSRF in script marking forum posts as read.

Marina Glancy 氏の報告：

- MSA-16-0013：ユーザーが、管理者によってロックされたプロファイルフィールドを変更できます。

- MSA-16-0015：非表示のフォーラム名およびサブ名の情報漏洩。

- MSA-16-0016：ユーザーが、適切なパーミッションなしで他のユーザーのバッジを表示できます。

- MSA-16-0017：コース idnumber が教師の復元から保護されていません。

- MSA-16-0018：フォーラムの投稿を既読にマークするスクリプトの CSRF。

Marina Glancy 报告：

- MSA-16-0013：用户能够变更系统管理员锁定的配置文件字段。

- MSA-16-0015：隐藏论坛名称与子名称的信息泄露。

- MSA-16-0016：用户可在无正确权限的情况下查看其他用户的徽标。

- MSA-16-0017：课程 id 编号未受到保护，可由老师还原。

- MSA-16-0018：脚本中的 CSRF 将论坛帖子标记为已读。

Marina Glancy 報告：

- MSA-16-0013：使用者能夠變更系統管理員鎖定的設定檔欄位。

- MSA-16-0015：隱藏論壇名稱與子名稱的資訊洩漏。

- MSA-16-0016：使用者可在無正確權限的情況下檢視其他使用者的徽章。

- MSA-16-0017：課程 id 編號未受到保護，可由老師還原。

- MSA-16-0018：指令碼中的 CSRF 將論壇貼文標記為已讀。

The remote web server hosts Moodle, an open-source course management system.  Versions of Moodle 2.7.x prior to 2.7.14 are exposed to the following vulnerabilities :

 - A flaw exists that may allow an attacker to have an unspecified impact.  No further details have been provided by the vendor.
 - A flaw exists that is due to the user editing form only disabling the profile fields in the UI and failing to restrict users from editing them.  This may allow an authenticated remote attacker to make changes to profiles. (CVE-2016-3729)
 - A flaw exists in the 'badges/lib.php' script that is triggered as capability checks to view other badges are performed for the current user instead for the user whose badges are being viewed.  This may allow an authenticated remote attacker to gain access to potentially sensitive information. (CVE-2016-3732)
 - A flaw exists in the 'backup/moodle2/restore_stepslib.php' script that may allow an authenticated remote attacker to overwrite the course ID number without having the proper authorization to do so. (CVE-2016-3733)
 - A flaw exists as HTTP requests to 'mod/forum/markposts.php' do not require multiple steps, explicit confirmation, or a unique token when performing certain sensitive actions.  By tricking a user into following a specially crafted link, a context-dependent attacker can perform a Cross-Site Request Forgery (CSRF / XSRF) attack causing the victim to mark a forum post as read. (CVE-2016-3734)

The remote web server hosts Moodle, an open-source course management system.  Versions of Moodle 2.8.x prior to 2.8.12, 2.9.x prior to 2.9.6 or 3.0.x prior to 3.0.4 are exposed to the following vulnerabilities :

 - A flaw exists that may allow an attacker to have an unspecified impact.  No further details have been provided by the vendor.
 - A flaw exists that is due to the user editing form only disabling the profile fields in the UI and failing to restrict users from editing them.  This may allow an authenticated remote attacker to make changes to profiles.
 - A flaw exists in the subscription page that is triggered during the handling of overly verbose error messages.  This may allow a remote attacker to gain access to the name of inaccessible forums or forum discussions.
 - A flaw exists in the 'badges/lib.php' script that is triggered as capability checks to view other badges are performed for the current user instead for the user whose badges are being viewed.  This may allow an authenticated remote attacker to gain access to potentially sensitive information.
 - A flaw exists in the 'backup/moodle2/restore_stepslib.php' script that may allow an authenticated remote attacker to overwrite the course ID number without having the proper authorization to do so.
 - A flaw exists as HTTP requests to 'mod/forum/markposts.php' do not require multiple steps, explicit confirmation, or a unique token when performing certain sensitive actions.  By tricking a user into following a specially crafted link, a context-dependent attacker can perform a Cross-Site Request Forgery (CSRF / XSRF) attack causing the victim to mark a forum post as read.

ID	名稱	產品	系列	已發布	已更新	嚴重性
91930	FreeBSD : moodle -- multiple vulnerabilities (8656cf5f-4170-11e6-8dfe-002590263bf5)	Nessus	FreeBSD Local Security Checks	2016/7/5	2021/1/4	high
91930	FreeBSD：moodle -- 複数の脆弱性（8656cf5f-4170-11e6-8dfe-002590263bf5）	Nessus	FreeBSD Local Security Checks	2016/7/5	2021/1/4	high
91930	FreeBSD：moodle -- 多种漏洞 (8656cf5f-4170-11e6-8dfe-002590263bf5)	Nessus	FreeBSD Local Security Checks	2016/7/5	2021/1/4	high
91930	FreeBSD：moodle -- 多個弱點 (8656cf5f-4170-11e6-8dfe-002590263bf5)	Nessus	FreeBSD Local Security Checks	2016/7/5	2021/1/4	high
9428	Moodle 2.7.x < 2.7.14 Multiple Vulnerabilities	Nessus Network Monitor	CGI	2016/7/21	2019/3/6	critical
9427	Moodle 2.8.x < 2.8.12 / 2.9.x < 2.9.6 / 3.0.x < 3.0.4 Multiple Vulnerabilities	Nessus Network Monitor	CGI	2016/7/21	2019/3/6	critical

偵測

搜尋 Plugin

high

high

high

high

critical

critical