Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Fri, 25 Jul 2008 11:39:42 -0400 (EDT)
From: "Steven M. Christey" <coley@...us.mitre.org>
To: oss-security@...ts.openwall.com
cc: cve@...re.org
Subject: Re: CVE id request: moodle XSS and CSRF


Notice thewebroot disclosure in CVE-2008-3327.

- Steve


======================================================
Name: CVE-2008-3325
Status: Candidate
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3325
Reference: MISC:http://www.procheckup.com/Vulnerability_PR08-16.php
Reference: CONFIRM:http://moodle.org/mod/forum/discuss.php?d=101405

Cross-site request forgery (CSRF) vulnerability in Moodle 1.6.x before
1.6.7 and 1.7.x before 1.7.5 allows remote attackers to modify profile
settings and gain privileges as other users via a link or IMG tag to
the user edit profile page.


======================================================
Name: CVE-2008-3326
Status: Candidate
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3326
Reference: MISC:http://www.procheckup.com/Vulnerability_PR08-13.php
Reference: CONFIRM:http://moodle.org/mod/forum/discuss.php?d=101401

Cross-site scripting (XSS) vulnerability in blog/edit.php in Moodle
1.6.x before 1.6.7 and 1.7.x before 1.7.5 allows remote attackers to
inject arbitrary web script or HTML via the etitle parameter (blog
entry title).


======================================================
Name: CVE-2008-3327
Status: Candidate
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3327
Reference: MISC:http://www.procheckup.com/Vulnerability_PR08-15.php
Reference: CONFIRM:http://moodle.org/mod/forum/discuss.php?d=101403

Moodle 1.6.5, when display_errors is enabled, allows remote attackers
to obtain the full installation path via a direct request to (1)
blog/blogpage.php and (2) course/report/stats/report.php, which leaks
the path in an error message.


Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.