Multiple weaknesses and vulnerabilities have been reported in Moodle, which can be exploited by malicious users to bypass certain security restrictions, disclose potentially sensitive data, conduct script insertion attacks, manipulate certain data, and to cause a DoS (Denial of Service) and by malicious people to bypass certain security restrictions and conduct cross-site scripting and cross-site request forgery attacks.

1) The weakness is caused due the chat feature allowing chat users to enumerate the full names of users.

2) The weakness is caused due to the global search feature not properly enforcing authorisation when being accessed through URLs directly.

The weaknesses #1 and #2 do not affect the 1.9.x versions.

3) Incorrect handling of the return code of the "openssl_verify()" function within the MNET feature can be exploited to bypass SSL certificate validation.

4) A weakness in the Cookie-less session feature can potentially be exploited to bypass certain security restrictions.

NOTE: The weakness affects the 1.9.x versions in the case of misconfiguration only.

5) An unspecified error can be exploited to disclose user names to unintended user groups.

6) Certain form data related to course section editing is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

This vulnerability does not affect the 2.x versions.

7) Due to an error during installation procedures, a certain secret value related to community hubs is not set.

8) The Box.net plugin does not implement the OAuth authentication features of the application.

9) An error within the category and course areas of the server files section can be exploited to disclose certain file information to unintended user groups.

10) Input passed to the "section" parameter is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

11) Certain input related to wiki comments is not properly sanitised before being used. This can be exploited to insert HTML and script code, which will be executed in a user's browser session in context of an affected site if malicious data is viewed.

12) The application allows users to perform certain actions via HTTP requests without performing proper validity checks to verify the requests. This can be exploited to e.g. perform certain actions on links when a logged-in user visits a specially crafted web page.

The vulnerabilities #7 through #12 do not affect the 1.9.x versions.

13) An error related to forms can be exploited to manipulate certain constant form values.

14) An error within message/refresh.php can be exploited to cause a DoS by providing a zero value for the "wait" parameter.

NOTE: Additionally certain database functions were hardened to prevent SQL injection attacks.

This vulnerability does not affect the 2.x versions.

Solution
Update to version 1.9.14, 2.0.5, or 2.1.2.

Provided and/or discovered by
The vendor credits:
1, 4, 10, 11, 12) Petr Škoda
2) Tatsuya Shirai
3, 13) David Mudrak
5) Rossiani Wijaya
6) Aaron Barnes
7) Colin Campbell
8) Alex Willen
9) Ralf Hilgenstock
14) Xavier Paz

Changelog
Further details available to Secunia VIM customers

Original Advisory
Moodle (MSA-11-0027, MSA-11-0028, MSA-11-0029, MSA-11-0030, MSA-11-0031, MSA-11-0032, MSA-11-0033, MSA-11-0034, MSA-11-0035, MSA-11-0036, MSA-11-0037, MSA-11-0038, MSA-11-0039, MSA-11-0040, MSA-11-0041):
http://moodle.org/mod/forum/discuss.php?d=188309
http://moodle.org/mod/forum/discuss.php?d=188310
http://moodle.org/mod/forum/discuss.php?d=188311
http://moodle.org/mod/forum/discuss.php?d=188312
http://moodle.org/mod/forum/discuss.php?d=188313
http://moodle.org/mod/forum/discuss.php?d=188314
http://moodle.org/mod/forum/discuss.php?d=188315
http://moodle.org/mod/forum/discuss.php?d=188316
http://moodle.org/mod/forum/discuss.php?d=188317
http://moodle.org/mod/forum/discuss.php?d=188318
http://moodle.org/mod/forum/discuss.php?d=188319
http://moodle.org/mod/forum/discuss.php?d=188320
http://moodle.org/mod/forum/discuss.php?d=188321
http://moodle.org/mod/forum/discuss.php?d=188322
http://moodle.org/mod/forum/discuss.php?d=188323

Deep Links
Links available to Secunia VIM customers