Moodle 2.3.x < 2.3.8 Multiple Vulnerabilities

The remote web server hosts Moodle, an open-source course management system. Versions of Moodle 2.3.x prior to 2.3.8 are exposed to the following vulnerabilities :

• A flaw exists in ‘mod/chat/gui_sockets/index.php’ that is due to the program failing to properly check for access. This may allow a remote attacker to access a daemon-mode Chat activity without proper permissions. (CVE-2013-2242)
• A flaw exists that may lead to the unauthorized disclosure of sensitive information. The issue is due to the program failing to properly restrict users using view source on pages. This may allow a remote attacker to gain access to answer information by obtaining ID values for Lesson activity matching questions. (CVE-2013-2243)
• A flaw exists that may lead to the unauthorized disclosure of sensitive information. The issue is due to block information related to the person being impersonated being shown shown along with an error message when an attacker is attempting to impersonate another user using RSS tokens. This may allow a remote attacker to gain access to sensitive information. (CVE-2013-2245)
• A flaw exists that may lead to the unauthorized disclosure of sensitive information. The issue is due to the feedback module failing to properly check for privileges in ‘feedback/lib.php’. This will result in personal information being exposed to a remote attacker. (CVE-2013-2246)
• A flaw exists in the IMS-LTI (External tool) module that may lead to the unauthorized disclosure of sensitive information. The issue is due to the program not allowing users to change privacy settings, which will result in personal information always being transferred. This may allow a remote attacker to gain access to sensitive information. (CVE-2013-4938)