Multiple vulnerabilities.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

複数の脆弱性。

注意：Tenable Network Security は、前述の記述ブロックを Fedora セキュリティアドバイザリから直接抽出しています。Tenable では、できる限り新たな問題を持ち込まないように、自動的に整理して書式設定するようにしています。

多個弱點。

請注意，Tenable Network Security 已直接從 Fedora 安全性公告擷取前置描述區塊。Tenable 已盡量在不造成其他問題的前提下，嘗試自動清理並將其格式化。

多种漏洞。

请注意，Tenable Network Security 已直接从 Fedora 安全公告中提取上述描述块。Tenable 已尝试在不引入其他问题的情况下尽可能进行了自动整理和排版。

The remote web server hosts Moodle, an open-source course management system.  Versions of Moodle 2.2.x prior to 2.2.5 are exposed to the following vulnerabilities :

 - A flaw exists that may allow a remote attacker to manipulate parameters for the 'repository/repository_ajax.php' script.  This will allow the attacker to bypass restrictions and upload a file that is larger than the allotted size. (CVE-2012-4400)
 - A flaw exists that is triggered when the application fails to properly restrict access to certain topic functions. This may allow a remote attacker to show or hide topics, as well as set a current topic. (CVE-2012-4401)
 - A flaw exists that is triggered when the 'webservice/lib.php' script fails to properly limit tokens to the service that issued them.  This may allow a remote attacker to use a token intended for one service to gain access to arbitrary other external services. (CVE-2012-4402)
 - A flaw exists that may lead to an unauthorized information disclosure.  The issue is triggered when the 'lib/filelib.php' script does not properly check the publication state of blog files.  This may allow a remote attacker to gain access to the embedded files of the blog before it is published. (CVE-2012-4407)
 - A flaw exists when permissions are not properly verified on the reset page.  This may allow a remote attacker to reset a course via the reset page. (CVE-2012-4408)

The remote web server hosts Moodle, an open-source course management system.  Versions of Moodle 2.3.x prior to 2.3.2 are exposed to the following vulnerabilities :

 - A flaw exists that may allow a remote attacker to manipulate parameters for the 'repository/repository_ajax.php script'.  This will allow the attacker to bypass restrictions and upload a file that is larger than the allotted size. (CVE-2012-4400)
 - A flaw exists that is triggered when the application fails to properly restrict access to certain topic functions.  This may allow a remote attacker to show or hide topics, as well as set a current topic. (CVE-2012-4401)
 - A flaw exists that is triggered when the 'webservice/lib.php' script fails to properly limit tokens to the service that issued them.  This may allow a remote attacker to use a token intended for one service to gain access to arbitrary other external services. (CVE-2012-4402)
 - A flaw exists that may lead to an unauthorized information disclosure.  The issue is triggered when a remote attacker creates a malformed request for the 'yui_combo.php' script, which discloses the software's installation path resulting in a loss of confidentiality.  While such information is relatively low risk, it is often useful in carrying out additional, more focused attacks. (CVE-2012-4403)
 - A flaw exists that may lead to an unauthorized information disclosure.  The issue is triggered when the 'lib/filelib.php' script does not properly check the publication state of blog files.  This may allow a remote attacker to gain access to the embedded files of the blog before it is published. (CVE-2012-4407)
 - A flaw exists when permissions are not properly verified on the reset page.  This may allow a remote attacker to reset a course via the reset page. (CVE-2012-4408)

The remote web server hosts Moodle, an open-source course management system.  Versions of Moodle 2.1.x prior to 2.1.8 are exposed to the following vulnerabilities :

 - A flaw exists that is triggered when the 'webservice/lib.php' script fails to properly limit tokens to the service that issued them.  This may allow a remote attacker to use a token intended for one service to gain access to arbitrary other external services. (CVE-2012-4402)
 - A flaw exists that may lead to an unauthorized information disclosure.  The issue is triggered when the 'lib/filelib.php' script does not properly check the publication state of blog files.  This may allow a remote attacker to gain access to the embedded files of the blog before it is published. (CVE-2012-4407)
 - A flaw exists when permissions are not properly verified on the reset page.  This may allow a remote attacker to reset a course via the reset page. (CVE-2012-4408)

ID	名前	製品	ファミリー	公開日	更新日	深刻度
62338	Fedora 17 : moodle-2.2.5-1.fc17 (2012-14348)	Nessus	Fedora Local Security Checks	2012/9/27	2021/1/11	medium
62338	Fedora 17：moodle-2.2.5-1.fc17（2012-14348）	Nessus	Fedora Local Security Checks	2012/9/27	2021/1/11	medium
62338	Fedora 17：moodle-2.2.5-1.fc17 (2012-14348)	Nessus	Fedora Local Security Checks	2012/9/27	2021/1/11	medium
62338	Fedora 17：moodle-2.2.5-1.fc17 (2012-14348)	Nessus	Fedora Local Security Checks	2012/9/27	2021/1/11	medium
9408	Moodle 2.2.x < 2.2.5 Multiple Vulnerabilities	Nessus Network Monitor	CGI	2016/7/21	2019/3/6	medium
9409	Moodle 2.3.x < 2.3.2 Multiple Vulnerabilities	Nessus Network Monitor	CGI	2016/7/21	2019/3/6	medium
9407	Moodle 2.1.x < 2.1.8 Multiple Vulnerabilities	Nessus Network Monitor	CGI	2016/7/21	2019/3/6	medium

検出

プラグインの検索

medium

medium

medium

medium

medium

medium

medium