GitHub Advisoryadvisory · Packagist

GHSA-m97f-x4mr-4x3q Moodle vulnerable to Cross-Site Request Forgery

MEDIUM Published 2022-05-13 Modified 2025-04-12 Official page ↗
Aliases
CVE-2011-4281
Ecosystem
Packagist
Packages
moodle/moodle
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U
Weaknesses
CWE-352
Reviewed
2025-04-12

Affected packages

• Packagist moodle/moodle: >= 2.0.0, < 2.0.2 → fixed in 2.0.2

Description

Multiple cross-site request forgery (CSRF) vulnerabilities in Moodle 2.0.x before 2.0.2 allow remote attackers to hijack the authentication of arbitrary users for requests that mark the completion of (1) an activity or (2) a course.

Related

Alias · CVE (1)

  • CVE-2011-4281 Multiple cross-site request forgery (CSRF) vulnerabilities in Moodle 2.0.x before 2.0.2 allow remote attackers to hijack the authentication… vulnerability

Weakness · CWE (1)

  • CWE-352 Cross-Site Request Forgery weakness

References