CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  What's the CVSS score of your company?
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Moodle : Security Vulnerabilities (CVSS score between 5 and 6.99)

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2021-43560 668 2021-11-22 2021-11-26
5.0
None Remote Low Not required Partial None None
A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions. Insufficient capability checks made it possible to fetch other users' calendar action events.
2 CVE-2021-43559 352 CSRF 2021-11-22 2021-11-26
6.8
None Remote Medium Not required Partial Partial Partial
A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions. The "delete related badge" functionality did not include the necessary token check to prevent a CSRF risk.
3 CVE-2021-20282 863 2021-03-15 2021-03-23
5.0
None Remote Low Not required None Partial None
When creating a user account, it was possible to verify the account without having access to the verification email link/secret in moodle before 3.10.2, 3.9.5, 3.8.8, 3.5.17.
4 CVE-2021-20281 200 +Info 2021-03-15 2021-03-23
5.0
None Remote Low Not required Partial None None
It was possible for some users without permission to view other users' full names to do so via the online users block in moodle before 3.10.2, 3.9.5, 3.8.8, 3.5.17.
5 CVE-2021-20187 94 2021-01-28 2021-02-01
6.5
None Remote Low ??? Partial Partial Partial
It was found in Moodle before version 3.10.1, 3.9.4, 3.8.7 and 3.5.16 that it was possible for site administrators to execute arbitrary PHP scripts via a PHP include used during Shibboleth authentication.
6 CVE-2021-20185 400 DoS 2021-01-28 2021-02-04
5.0
None Remote Low Not required None None Partial
It was found in Moodle before version 3.10.1, 3.9.4, 3.8.7 and 3.5.16 that messaging did not impose a character limit when sending messages, which could result in client-side (browser) denial of service for users receiving very large messages.
7 CVE-2020-25703 200 +Info 2020-11-19 2021-10-19
5.0
None Remote Low Not required Partial None None
The participants table download in Moodle always included user emails, but should have only done so when users' emails are not hidden. Versions affected: 3.9 to 3.9.2, 3.8 to 3.8.5 and 3.7 to 3.7.8. This is fixed in moodle 3.9.3, 3.8.6, 3.7.9, and 3.10.
8 CVE-2020-25701 863 2020-11-19 2020-12-01
5.0
None Remote Low Not required None Partial None
If the upload course tool in Moodle was used to delete an enrollment method which did not exist or was not already enabled, the tool would erroneously enable that enrollment method. This could lead to unintended users gaining access to the course. Versions affected: 3.9 to 3.9.2, 3.8 to 3.8.5, 3.7 to 3.7.8, 3.5 to 3.5.14 and earlier unsupported versions. This is fixed in moodle 3.9.3, 3.8.6, 3.7.9, 3.5.15, and 3.10.
9 CVE-2020-25699 863 2020-11-19 2021-10-19
5.0
None Remote Low Not required None Partial None
In moodle, insufficient capability checks could lead to users with the ability to course restore adding additional capabilities to roles within that course. Versions affected: 3.9 to 3.9.2, 3.8 to 3.8.5, 3.7 to 3.7.8, 3.5 to 3.5.14 and earlier unsupported versions. This is fixed in moodle 3.9.3, 3.8.6, 3.7.9, 3.5.15, and 3.10.
10 CVE-2020-25698 2020-11-19 2020-12-02
5.0
None Remote Low Not required None Partial None
Users' enrollment capabilities were not being sufficiently checked in Moodle when they are restored into an existing course. This could lead to them unenrolling users without having permission to do so. Versions affected: 3.5 to 3.5.14, 3.7 to 3.7.8, 3.8 to 3.8.5, 3.9 to 3.9.2 and earlier unsupported versions. Fixed in 3.9.3, 3.8.6, 3.7.9, 3.5.15, and 3.10.
11 CVE-2020-25630 400 DoS 2020-12-08 2020-12-08
5.0
None Remote Low Not required None None Partial
A vulnerability was found in Moodle where the decompressed size of zip files was not checked against available user quota before unzipping them, which could lead to a denial of service risk. This affects versions 3.9 to 3.9.1, 3.8 to 3.8.4, 3.7 to 3.7.7, 3.5 to 3.5.13 and earlier unsupported versions. Fixed in 3.9.2, 3.8.5, 3.7.8 and 3.5.14.
12 CVE-2020-25629 284 2020-12-08 2020-12-08
6.5
None Remote Low ??? Partial Partial Partial
A vulnerability was found in Moodle where users with "Log in as" capability in a course context (typically, course managers) may gain access to some site administration capabilities by "logging in as" a System manager. This affects 3.9 to 3.9.1, 3.8 to 3.8.4, 3.7 to 3.7.7, 3.5 to 3.5.13 and earlier unsupported versions. This is fixed in 3.9.2, 3.8.5, 3.7.8 and 3.5.14.
13 CVE-2020-10738 20 Exec Code 2020-05-21 2020-05-22
6.5
None Remote Low ??? Partial Partial Partial
A flaw was found in Moodle versions 3.8 before 3.8.3, 3.7 before 3.7.6, 3.6 before 3.6.10, 3.5 before 3.5.12 and earlier unsupported versions. It was possible to create a SCORM package in such a way that when added to a course, it could be interacted with via web services in order to achieve remote code execution.
14 CVE-2019-14882 601 2020-03-18 2020-03-19
5.8
None Remote Medium Not required Partial Partial None
A vulnerability was found in Moodle 3.7 to 3.7.3, 3.6 to 3.6.7, 3.5 to 3.5.9 and earlier where an open redirect existed in the Lesson edit page.
15 CVE-2019-14880 2020-03-31 2020-04-02
6.4
None Remote Low Not required Partial Partial None
A vulnerability was found in Moodle versions 3.7 before 3.7.3, 3.6 before 3.6.7, 3.5 before 3.5.9 and earlier. OAuth 2 providers who do not verify users' email address changes require additional verification during sign-up to reduce the risk of account compromise.
16 CVE-2019-14879 273 2020-01-07 2020-03-31
5.5
None Remote Low ??? Partial Partial None
A vulnerability was found in Moodle versions 3.7.x before 3.7.3, 3.6.x before 3.6.7 and 3.5.x before 3.5.9. When a cohort role assignment was removed, the associated capabilities were not being revoked (where applicable).
17 CVE-2019-14831 601 2021-03-19 2021-03-22
5.8
None Remote Medium Not required Partial Partial None
A vulnerability was found in Moodle 3.7 to 3.7.1, 3.6 to 3.6.5, 3.5 to 3.5.7 and earlier unsupported versions, where forum subscribe link contained an open redirect if forced subscription mode was enabled. If a forum's subscription mode was set to "forced subscription", the forum's subscribe link contained an open redirect.
18 CVE-2019-14830 601 2021-03-19 2021-03-22
5.8
None Remote Medium Not required Partial Partial None
A vulnerability was found in Moodle 3.7 to 3.7.1, 3.6 to 3.6.5, 3.5 to 3.5.7 and earlier unsupported versions, where the mobile launch endpoint contained an open redirect in some circumstances, which could result in a user's mobile access token being exposed. (Note: This does not affect sites with a forced URL scheme configured, mobile service disabled, or where the mobile app login method is "via the app").
19 CVE-2019-10186 352 CSRF 2019-07-31 2019-08-27
6.8
None Remote Medium Not required Partial Partial Partial
A flaw was found in moodle before versions 3.7.1, 3.6.5, 3.5.7. A sesskey (CSRF) token was not being utilised by the XML loading/unloading admin tool.
20 CVE-2019-10154 2019-06-26 2020-09-30
5.0
None Remote Low Not required Partial None None
A flaw was found in Moodle before versions 3.7, 3.6.4. A web service fetching messages was not restricted to the current user's conversations.
21 CVE-2019-10133 601 2019-06-26 2019-10-09
5.8
None Remote Medium Not required Partial Partial None
A flaw was found in Moodle before 3.7, 3.6.4, 3.5.6, 3.4.9 and 3.1.18. The form to upload cohorts contained a redirect field, which was not restricted to internal URLs.
22 CVE-2019-6970 918 2019-03-21 2019-03-22
6.0
None Remote Medium ??? Partial Partial Partial
Moodle 3.5.x before 3.5.4 allows SSRF.
23 CVE-2019-3850 601 2019-03-26 2019-10-09
5.8
None Remote Medium Not required Partial Partial None
A vulnerability was found in moodle before versions 3.6.3, 3.5.5, 3.4.8 and 3.1.17. Links within assignment submission comments would open directly (in the same window). Although links themselves may be valid, opening within the same window and without the no-referrer header policy made them more susceptible to exploits.
24 CVE-2019-3849 269 2019-03-26 2020-10-16
6.5
None Remote Low ??? Partial Partial Partial
A vulnerability was found in moodle before versions 3.6.3, 3.5.5 and 3.4.8. Users could assign themselves an escalated role within courses or content accessed via LTI, by modifying the request to the LTI publisher site.
25 CVE-2019-3810 79 XSS 2019-03-25 2021-11-04
5.0
None Remote Low Not required Partial None None
A flaw was found in moodle versions 3.6 to 3.6.1, 3.5 to 3.5.3, 3.4 to 3.4.6, 3.1 to 3.1.15 and earlier unsupported versions. The /userpix/ page did not escape users' full names, which are included as text when hovering over profile images. Note this page is not linked to by default and its access is restricted.
26 CVE-2018-16854 352 CSRF 2018-11-26 2019-10-09
6.8
None Remote Medium Not required Partial Partial Partial
A flaw was found in moodle versions 3.5 to 3.5.2, 3.4 to 3.4.5, 3.3 to 3.3.8, 3.1 to 3.1.14 and earlier. The login form is not protected by a token to prevent login cross-site request forgery. Fixed versions include 3.6, 3.5.3, 3.4.6, 3.3.9 and 3.1.15.
27 CVE-2018-14630 94 Exec Code 2018-09-17 2019-10-09
6.5
None Remote Low ??? Partial Partial Partial
moodle before versions 3.5.2, 3.4.5, 3.3.8, 3.1.14 is vulnerable to an XML import of ddwtos could lead to intentional remote code execution. When importing legacy 'drag and drop into text' (ddwtos) type quiz questions, it was possible to inject and execute PHP code from within the imported questions, either intentionally or by importing questions from an untrusted source.
28 CVE-2018-10890 200 +Info 2018-07-10 2019-10-09
5.0
None Remote Low Not required Partial None None
A flaw was found in moodle before versions 3.5.1, 3.4.4, 3.3.7, 3.1.13. It was possible for the core_course_get_categories web service to return hidden categories, which should be omitted when fetching course categories.
29 CVE-2018-10889 532 2018-07-10 2019-10-09
5.0
None Remote Low Not required Partial None None
A flaw was found in moodle before versions 3.5.1, 3.4.4, 3.3.7. No option existed to omit logs from data privacy exports, which may contain details of other users who interacted with the requester.
30 CVE-2018-1137 20 2018-05-25 2018-06-25
5.5
None Remote Low ??? None Partial Partial
An issue was discovered in Moodle 3.x. By substituting URLs in portfolios, users can instantiate any class. This can also be exploited by users who are logged in as guests to create a DDoS attack.
31 CVE-2018-1133 94 Exec Code 2018-05-25 2020-08-24
6.5
None Remote Low ??? Partial Partial Partial
An issue was discovered in Moodle 3.x. A Teacher creating a Calculated question can intentionally cause remote code execution on the server, aka eval injection.
32 CVE-2018-1082 287 2018-04-04 2019-10-09
6.8
None Remote Medium Not required Partial Partial Partial
A flaw was found in Moodle 3.4 to 3.4.1, and 3.3 to 3.3.4. If a user account using OAuth2 authentication method was once confirmed but later suspended, the user could still login to the site.
33 CVE-2018-1081 2018-04-04 2020-08-28
5.0
None Remote Low Not required None Partial None
A flaw was found in Moodle 3.4 to 3.4.1, 3.3 to 3.3.4, 3.2 to 3.2.7, 3.1 to 3.1.10 and earlier unsupported versions. Unauthenticated users can trigger custom messages to admin via paypal enrol script. Paypal IPN callback script should only send error emails to admin after request origin was verified, otherwise admin email can be spammed.
34 CVE-2017-7490 668 2017-05-15 2019-10-03
5.0
None Remote Low Not required Partial None None
In Moodle 2.x and 3.x, searching of arbitrary blogs is possible because a capability check is missing.
35 CVE-2017-7489 269 2017-05-15 2019-10-03
6.5
None Remote Low ??? Partial Partial Partial
In Moodle 2.x and 3.x, remote authenticated users can take ownership of arbitrary blogs by editing an external blog link.
36 CVE-2017-2643 200 +Info 2017-03-26 2017-07-12
5.0
None Remote Low Not required Partial None None
In Moodle 3.2.x, global search displays user names for unauthenticated users.
37 CVE-2017-2576 20 2017-01-20 2020-12-01
5.0
None Remote Low Not required None Partial None
In Moodle 2.x and 3.x, there is incorrect sanitization of attributes in forums.
38 CVE-2016-9187 434 Exec Code 2016-11-04 2016-11-29
6.5
None Remote Low ??? Partial Partial Partial
Unrestricted file upload vulnerability in the double extension support in the "image" module in Moodle 3.1.2 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, and then accessing it via unspecified vectors.
39 CVE-2016-9186 434 Exec Code 2016-11-04 2016-11-29
6.5
None Remote Low ??? Partial Partial Partial
Unrestricted file upload vulnerability in the "legacy course files" and "file manager" modules in Moodle 3.1.2 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, and then accessing it via unspecified vectors.
40 CVE-2016-8644 264 2017-01-20 2020-12-01
5.0
None Remote Low Not required Partial None None
In Moodle 2.x and 3.x, the capability to view course notes is checked in the wrong context.
41 CVE-2016-8642 284 2017-01-20 2020-12-01
5.0
None Remote Low Not required Partial None None
In Moodle 2.x and 3.x, the question engine allows access to files that should not be available.
42 CVE-2016-7919 200 Sql +Info 2016-10-28 2016-12-02
5.0
None Remote Low Not required Partial None None
** DISPUTED ** Moodle 3.1.2 allows remote attackers to obtain sensitive information via unspecified vectors, related to a "SQL Injection" issue affecting the Administration panel function in the installation process component. NOTE: the vendor disputes the relevance of this report, noting that "the person who is installing Moodle must know database access credentials and they can access the database directly; there is no need for them to create a SQL injection in one of the installation dialogue fields."
43 CVE-2016-7038 640 2017-01-20 2020-12-01
5.0
None Remote Low Not required Partial None None
In Moodle 2.x and 3.x, web service tokens are not invalidated when the user password is changed or forced to be changed.
44 CVE-2016-5014 200 +Info 2017-01-20 2020-12-01
5.8
None Remote Medium Not required Partial Partial None
In Moodle 2.x and 3.x, an unenrolled user still receives event monitor notifications even though they can no longer access the course.
45 CVE-2016-5013 74 2017-01-20 2020-12-01
5.8
None Remote Medium Not required Partial Partial None
In Moodle 2.x and 3.x, text injection can occur in email headers, potentially leading to outbound spam.
46 CVE-2016-5012 200 +Info 2017-01-20 2017-01-25
5.0
None Remote Low Not required Partial None None
In Moodle 3.x, glossary search displays entries without checking user permissions to view them.
47 CVE-2016-3734 352 CSRF 2017-04-20 2020-12-01
6.8
None Remote Medium Not required Partial Partial Partial
Cross-site request forgery (CSRF) vulnerability in markposts.php in Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, 2.8 through 2.8.11, 2.7 through 2.7.13 and earlier allows remote attackers to hijack the authentication of users for requests that marks forum posts as read.
48 CVE-2016-3731 200 +Info 2017-04-20 2020-12-01
5.0
None Remote Low Not required Partial None None
Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, and 2.8 through 2.8.11 allows remote attackers to obtain the names of hidden forums and forum discussions.
49 CVE-2016-2190 264 +Info 2016-05-22 2020-12-01
5.0
None Remote Low Not required Partial None None
Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 does not properly restrict links, which allows remote attackers to obtain sensitive URL information by reading a Referer log.
50 CVE-2016-2157 352 CSRF 2016-05-22 2020-12-01
6.8
None Remote Medium Not required Partial Partial Partial
Cross-site request forgery (CSRF) vulnerability in mod/assign/adminmanageplugins.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 allows remote attackers to hijack the authentication of administrators for requests that manage Assignment plugins.
Total number of vulnerabilities : 165   Page : 1 (This Page)2 3 4
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.