CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:L/Au:N/C:P/I:N/A:N
EPSS
Percentile
72.2%
The remote web server hosts Moodle, an open-source course management system. Versions of Moodle 2.6.x prior to 2.6.6, or 2.7.x prior to 2.7.3 are exposed to the following vulnerabilities :
A security bypass flaw exists in ‘mod/forum/externallib.php’ because it does not verify group permissions. This could allow remote authenticated users to access any forum via the ‘forum_get_discussions’ web service. (MSA-14-0043 / CVE-2014-7834)
An information disclosure flaw exists in ‘lib/phpunit/bootstrap.php’. By directly accessing an internal file, an unauthenticated user can be shown an error message containing the file system path of the Moodle install. (MSA-14-0044 / CVE-2014-7848)
A cross-site scripting (XSS) vulnerability exists in the profile picture area. An authenticated user could upload a file which contains malicious JavaScript as their profile picture to attack any users which access the affected profile. (MSA-14-0045 / CVE-2014-7835)
Binary data 8720.prm
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7834
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7835
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7848
moodle.org/security
www.nessus.org/u?e73e48cd
moodle.org/mod/forum/discuss.php?d=275159
moodle.org/mod/forum/discuss.php?d=275160
moodle.org/mod/forum/discuss.php?d=275161