Cross-site request forgery (CSRF) vulnerability in report/overview/report.php in the quiz module in Moodle before 1.8.13 and 1.9.x before 1.9.9 allows remote attackers to hijack the authentication of arbitrary users for requests that delete quiz attempts via the attemptid parameter.
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Moodle | — | Upgrade to the latest version of Moodle | Dec 4, 2018 | Jun 28, 2010 |
| Suse | — | Upgrade moodle-tlUpgrade moodle-kaUpgrade moodle-jaUpgrade moodle-viUpgrade moodle-afUpgrade moodle-ukUpgrade moodle-bsUpgrade moodle-arUpgrade moodle-kmUpgrade moodle-csUpgrade moodle-plUpgrade moodle-ruUpgrade moodle-lvUpgrade moodle-skUpgrade moodle-deUpgrade moodle-frUpgrade moodle-itUpgrade moodle-noUpgrade moodle-thUpgrade moodle-etUpgrade moodle-hrUpgrade moodleUpgrade moodle-isUpgrade moodle-srUpgrade moodle-fiUpgrade moodle-bgUpgrade moodle-ptUpgrade moodle-daUpgrade moodle-nlUpgrade moodle-knUpgrade moodle-euUpgrade moodle-mi_tnUpgrade moodle-roUpgrade moodle-glUpgrade moodle-esUpgrade moodle-koUpgrade moodle-de_duUpgrade moodle-elUpgrade moodle-beUpgrade moodle-soUpgrade moodle-sqUpgrade moodle-heUpgrade moodle-huUpgrade moodle-trUpgrade moodle-nnUpgrade moodle-msUpgrade moodle-svUpgrade moodle-hiUpgrade moodle-caUpgrade moodle-slUpgrade moodle-faUpgrade moodle-gaUpgrade moodle-zh_cnUpgrade moodle-idUpgrade moodle-lt | Feb 17, 2015 | Jun 28, 2010 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub