CVE-2015-0213

Multiple cross-site request forgery (CSRF) vulnerabilities in (1) editcategories.html and (2) editcategories.php in the Glossary module in Moodle through 2.5.9, 2.6.x before 2.6.7, 2.7.x before 2.7.4, and 2.8.x before 2.8.2 allow remote attackers to hijack the authentication of unspecified victims.

Multiple cross-site request forgery (CSRF) vulnerabilities in (1) editcategories.html and (2) editcategories.php in the Glossary module in Moodle through 2.5.9, 2.6.x before 2.6.7, 2.7.x before 2.7.4, and 2.8.x before 2.8.2 allow remote attackers to hijack the authentication of unspecified victims.

Multiple cross-site request forgery (CSRF) vulnerabilities in (1) editcategories.html and (2) editcategories.php in the Glossary module in Moodle through 2.5.9, 2.6.x before 2.6.7, 2.7.x before 2.7.4, and 2.8.x before 2.8.2 allow remote attackers to hijack the authentication of unspecified victims.

Multiple cross-site request forgery (CSRF) vulnerabilities in (1) editcategories.html and (2) editcategories.php in the Glossary module in Moodle through 2.5.9, 2.6.x before 2.6.7, 2.7.x before 2.7.4, and 2.8.x before 2.8.2 allow remote attackers to hijack the authentication of unspecified victims.

Multiple cross-site request forgery (CSRF) vulnerabilities in (1) editcategories.html and (2) editcategories.php in the Glossary module in Moodle through 2.5.9, 2.6.x before 2.6.7, 2.7.x before 2.7.4, and 2.8.x before 2.8.2 allow remote attackers to hijack the authentication of unspecified victims.

Updated moodle package fixes security vulnerabilities:

In Moodle before 2.6.7, absence of a capability check in AJAX backend script in the LTI module could allow any enrolled user to search the list of registered tools (CVE-2015-0211).

In Moodle before 2.6.7, the course summary on course request pending approval page was displayed to the manager unescaped and could be used for XSS attack (CVE-2015-0212).

In Moodle before 2.6.7, two files in the Glossary module lacked a session key check potentially allowing cross-site request forgery (CVE-2015-0213).

In Moodle before 2.6.7, through web-services it was possible to access messaging-related functions such as people search even if messaging is disabled on the site (CVE-2015-0214).

In Moodle before 2.6.7, through web-services it was possible to get information about calendar events which user did not have enough permissions to see (CVE-2015-0215).

In Moodle before 2.6.7, non-optimal regular expression in the multimedia filter could be exploited to create extra server load or make particular page unavailable, resulting in a denial of service (CVE-2015-0217).

In Moodle before 2.6.7, it was possible to forge a request to logout users even when not authenticated through Shibboleth (CVE-2015-0218).

Multiple cross-site request forgery (CSRF) vulnerabilities in (1) editcategories.html and (2) editcategories.php in the Glossary module in Moodle through 2.5.9, 2.6.x before 2.6.7, 2.7.x before 2.7.4, and 2.8.x before 2.8.2 allow remote attackers to hijack the authentication of unspecified victims.