Moodle 2.3.x < 2.3.11 Multiple Vulnerabilities

The remote web server hosts Moodle, an open-source course management system. Versions of Moodle 2.3.x prior to 2.3.11 are exposed to the following vulnerabilities :

• A flaw exists that is due to the program failing to apply group constraints when handling a request from a specially crafted URL. This may allow a remote attacker to bypass authentication and login as a user outside of the groups in which they are authorized to do so. (CVE-2014-0009)
• A flaw exists as HTTP requests to ‘user/profile/index.php’ do not require multiple steps, explicit confirmation, or a unique token when performing certain sensitive actions. By tricking a user into following a specially crafted link, a context-dependent attacker can perform a Cross-Site Request Forgery (CSRF / XSRF) attack causing the victim to delete custom user profile fields and categories. (CVE-2014-0010)