CVE-2012-5471 moodle: Various security issues fixed in upstream 2.3.3, 2.2.6 and 2.1.9 versions (MSA-12-0057, MSA-12-0058, MSA-12-0059, MSA-12-0060, MSA-12-0061, MSA-12-0062, MSA-12-0063)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

CVE-2012-5471 ムードル：Upstream 2.3.3、2.2.6 および 2.1.9 バージョンで、様々なセキュリティ問題が修正されました（MSA-12-0057、MSA-12-0058、MSA-12-0059、MSA-12-0060、MSA-12-0061、MSA-12-0062、MSA-12-0063）

注意：Tenable Network Security は、前述の記述ブロックを Fedora セキュリティアドバイザリから直接抽出しています。Tenable では、できる限り新たな問題を持ち込まないように、自動的に整理して書式設定するようにしています。

CVE-2012-5471 moodle：上游 2.3.3、2.2.6 和 2.1.9 版本修复了各种安全问题（MSA-12-0057、MSA-12-0058、MSA-12-0059、MSA-12-0060、MSA-12-0061、MSA-12-0062、MSA-12-0063）

请注意，Tenable Network Security 已直接从 Fedora 安全公告中提取上述描述块。Tenable 已尝试在不引入其他问题的情况下尽可能进行了自动整理和排版。

CVE-2012-5471 moodle：上游 2.3.3、2.2.6 和 2.1.9 版中的多種安全性問題修正 (MSA-12-0057、MSA-12-0058、MSA-12-0059、MSA-12-0060、MSA-12-0061、MSA-12-0062、MSA-12-0063)

請注意，Tenable Network Security 已直接從 Fedora 安全性公告擷取前置描述區塊。Tenable 已盡量在不造成其他問題的前提下，嘗試自動清理並將其格式化。

The remote web server hosts Moodle, an open-source course management system.  Versions of Moodle 2.1.x prior to 2.1.9, 2.2.x prior to 2.2.6, and 2.3.x prior to 2.3.3 are affected by multiple vulnerabilities :

 - A flaw exists that is due to the program not properly terminating sessions when a user disconnects from Moodle.  This may allow an attacker with physical access to the computer to more easily access a user's dropbox repository. (CVE-2012-5471)
 - A flaw exists that is triggered during the handling of a specially crafted value of a frozen form field.  This may allow a remote authenticated attacker to bypass access restrictions. (CVE-2012-5472)
 - A flaw exists that is due to the Database Activity module not properly restricting access to activity entries.  This may allow a remote authenticated attacker to gain access to arbitrary users' activity entries via an advanced search. (CVE-2012-5473)
 - A flaw exists that allows a remote user to execute arbitrary code.  This flaw exists because the Portfolio plugin does not properly verify or sanitize user-uploaded files.  By uploading a specially crafted API Callback file, the remote system will place the file in a user-accessible path.  Making a direct request to the uploaded file will allow the user to execute the script with the privileges of the web server. (CVE-2012-5479)
 - A flaw exists related to the Database activity module, which may allow a remote attacker to bypass intended access restrictions.  With an advanced search the attacker may be able to read other participants' entries. (CVE-2012-5480)
 - A flaw exists that may lead to an unauthorized information disclosure.  The issue may allow a remote authenticated attacker to bypass the 'moodle/role:manage' capability requirement, which will allow the attacker to read all capability data via the check permissions page. (CVE-2012-5481)

ID	名前	製品	ファミリー	公開日	更新日	深刻度
63085	Fedora 17 : moodle-2.2.6-1.fc17 (2012-18525)	Nessus	Fedora Local Security Checks	2012/11/29	2021/1/11	medium
63053	Fedora 18 : moodle-2.3.3-1.fc18 (2012-18598)	Nessus	Fedora Local Security Checks	2012/11/27	2021/1/11	medium
63087	Fedora 16 : moodle-2.1.9-1.fc16 (2012-18570)	Nessus	Fedora Local Security Checks	2012/11/29	2021/1/11	medium
63053	Fedora 18：moodle-2.3.3-1.fc18（2012-18598）	Nessus	Fedora Local Security Checks	2012/11/27	2021/1/11	medium
63085	Fedora 17：moodle-2.2.6-1.fc17（2012-18525）	Nessus	Fedora Local Security Checks	2012/11/29	2021/1/11	medium
63087	Fedora 16：moodle-2.1.9-1.fc16 (2012-18570)	Nessus	Fedora Local Security Checks	2012/11/29	2021/1/11	medium
63085	Fedora 17：moodle-2.2.6-1.fc17 (2012-18525)	Nessus	Fedora Local Security Checks	2012/11/29	2021/1/11	medium
63053	Fedora 18：moodle-2.3.3-1.fc18 (2012-18598)	Nessus	Fedora Local Security Checks	2012/11/27	2021/1/11	medium
63087	Fedora 16：moodle-2.1.9-1.fc16 (2012-18570)	Nessus	Fedora Local Security Checks	2012/11/29	2021/1/11	medium
63087	Fedora 16：moodle-2.1.9-1.fc16（2012-18570）	Nessus	Fedora Local Security Checks	2012/11/29	2021/1/11	medium
63085	Fedora 17：moodle-2.2.6-1.fc17 (2012-18525)	Nessus	Fedora Local Security Checks	2012/11/29	2021/1/11	medium
63053	Fedora 18：moodle-2.3.3-1.fc18 (2012-18598)	Nessus	Fedora Local Security Checks	2012/11/27	2021/1/11	medium
9528	Moodle 2.1.x < 2.1.9 / 2.2.x < 2.2.6 / 2.3.x < 2.3.3 Multiple Vulnerabilities	Nessus Network Monitor	CGI	2016/8/25	2019/3/6	medium

検出

プラグインの検索

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium