CVE-2008-3325

Moodle 1.6-1.6.6 and 1.7-1.7.4 - Cross-Site Request Forgery via User Profile Edit Page

Title source: llm
STIX 2.1

Description

Cross-site request forgery (CSRF) vulnerability in Moodle 1.6.x before 1.6.7 and 1.7.x before 1.7.5 allows remote attackers to modify profile settings and gain privileges as other users via a link or IMG tag to the user edit profile page.

References (8)

Core 8
Core References
Patch, Vendor Advisory x_refsource_confirm
http://moodle.org/mod/forum/discuss.php?d=101405
Third Party Advisory vendor-advisory x_refsource_suse
http://lists.opensuse.org/opensuse-security-announce/2008-08/msg00001.html
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/31196
Third Party Advisory vendor-advisory x_refsource_debian
http://www.debian.org/security/2008/dsa-1691
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/494658/100/0/threaded
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/31339

Scores

EPSS 0.0040
EPSS Percentile 60.7%

Details

CWE
CWE-352
Status published
Products (2)
debian/debian_linux 4.0
moodle/moodle 1.6 - 1.6.7
Published Jul 25, 2008
Tracked Since Feb 18, 2026