| Title | Moodle の LTI mod_form の実装における重要な情報を取得される脆弱性 |
|---|---|
| Summary | Moodle の LTI (別名 IMS-LTI) mod_form の実装は、sendname、sendemailaddr、および acceptgrades の設定を適切にサポートしないため、重要な情報を取得される脆弱性が存在します。 |
| Possible impacts | 第三者により、より安全な値を有効にしようとして失敗した状況を利用されることで、重要な情報を取得される可能性があります。 |
| Solution | ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。 |
| Publication Date | July 15, 2013, midnight |
| Registration Date | July 30, 2013, 4:18 p.m. |
| Last Update | July 30, 2013, 4:18 p.m. |
| CVSS2.0 : 警告 | |
| Score | 4.3 |
|---|---|
| Vector | AV:N/AC:M/Au:N/C:P/I:N/A:N |
| Moodle |
| Moodle 2.1.10 まで |
| Moodle 2.2.11 未満の 2.2.x |
| Moodle 2.3.8 未満の 2.3.x |
| Moodle 2.4.5 未満の 2.4.x |
| Moodle 2.5.1 未満の 2.5.x |
| No | Changed Details | Date of change |
|---|---|---|
| 0 | [2013年07月30日] 掲載 |
Feb. 17, 2018, 10:37 a.m. |
| Summary | The LTI (aka IMS-LTI) mod_form implementation in Moodle through 2.1.10, 2.2.x before 2.2.11, 2.3.x before 2.3.8, 2.4.x before 2.4.5, and 2.5.x before 2.5.1 does not properly support the sendname, sendemailaddr, and acceptgrades settings, which allows remote attackers to obtain sensitive information in opportunistic circumstances by leveraging an environment in which there was an ineffective attempt to enable the more secure values. |
|---|---|
| Publication Date | July 29, 2013, 10:59 p.m. |
| Registration Date | Jan. 26, 2021, 3:44 p.m. |
| Last Update | Nov. 21, 2024, 10:56 a.m. |
| Configuration1 | or higher | or less | more than | less than | |
| cpe:2.3:a:moodle:moodle:2.1.2:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:moodle:moodle:2.1.10:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:moodle:moodle:2.1.8:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:moodle:moodle:2.1.9:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:moodle:moodle:2.1.1:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:moodle:moodle:2.1.5:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:moodle:moodle:2.1.6:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:moodle:moodle:2.1.3:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:moodle:moodle:2.1.7:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:moodle:moodle:2.1.4:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:moodle:moodle:2.1.0:*:*:*:*:*:*:* | |||||
| Configuration2 | or higher | or less | more than | less than | |
| cpe:2.3:a:moodle:moodle:2.2.2:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:moodle:moodle:2.2.9:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:moodle:moodle:2.2.6:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:moodle:moodle:2.2.8:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:moodle:moodle:2.2.10:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:moodle:moodle:2.2.1:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:moodle:moodle:2.2.7:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:moodle:moodle:2.2.3:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:moodle:moodle:2.2.5:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:moodle:moodle:2.2.4:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:moodle:moodle:2.2.0:*:*:*:*:*:*:* | |||||
| Configuration3 | or higher | or less | more than | less than | |
| cpe:2.3:a:moodle:moodle:2.3.4:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:moodle:moodle:2.3.1:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:moodle:moodle:2.3.6:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:moodle:moodle:2.3.5:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:moodle:moodle:2.3.3:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:moodle:moodle:2.3.7:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:moodle:moodle:2.3.2:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:moodle:moodle:2.3.0:*:*:*:*:*:*:* | |||||
| Configuration4 | or higher | or less | more than | less than | |
| cpe:2.3:a:moodle:moodle:2.4.3:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:moodle:moodle:2.4.1:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:moodle:moodle:2.4.2:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:moodle:moodle:2.4.4:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:moodle:moodle:2.4.0:*:*:*:*:*:*:* | |||||
| Configuration5 | or higher | or less | more than | less than | |
| cpe:2.3:a:moodle:moodle:2.5.0:*:*:*:*:*:*:* | |||||