Description
Cross-site request forgery (CSRF) vulnerability in report/overview/report.php in the quiz module in Moodle before 1.8.13 and 1.9.x before 1.9.9 allows remote attackers to hijack the authentication of arbitrary users for requests that delete quiz attempts via the attemptid parameter.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 5.0 | moodle | 1.8.13-1 | DSA-2115-1 |
Advisories 1
- DSA-2115-1 moodle - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
References
- http://docs.moodle.org/en/Moodle_1.8.13_release_notes
- FEDORA-2010-10286 vendor-advisory
- ADV-2010-1571 vdb-entry
- [oss-security] 20100621 Re: CVE request: moodle 1.9.9/1.8.13 multiple vulnerabilities mailing-list
- 40352 third-party-advisory
- ADV-2010-1530 vdb-entry
- FEDORA-2010-10321 vendor-advisory
- http://moodle.org/mod/forum/discuss.php?d=152369
- http://docs.moodle.org/en/Moodle_1.9.9_release_notes
- 40248 third-party-advisory
- FEDORA-2010-10291 vendor-advisory
- http://tracker.moodle.org/browse/MDL-21688
- SUSE-SR:2010:014 vendor-advisory
- http://cvs.moodle.org/moodle/mod/quiz/report/overview/report.php?r1=1.98.2.50&r2=1.98.2.51
- https://bugzilla.redhat.com/show_bug.cgi?id=605809