{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Moodle versions 1.8.x ant\u00e9rieures \u00e0 1.8.11 ;",
      "product": {
        "name": "Moodle",
        "vendor": {
          "name": "Moodle",
          "scada": false
        }
      }
    },
    {
      "description": "Moodle versions 1.9.x ant\u00e9rieures \u00e0 1.9.7.",
      "product": {
        "name": "Moodle",
        "vendor": {
          "name": "Moodle",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Description\n\nDe multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Moodle. La plupart\nd\u0027entre elles concernent la protection des identifiants de connexion et\npeuvent \u00eatre exploit\u00e9es afin de se connecter en tant que\nd\u0027administrateur. D\u0027autres vuln\u00e9rabilit\u00e9s permettent de r\u00e9aliser des\ninjections SQL ou des injections de requ\u00eates ill\u00e9gitimes par rebond\n(attaques de type CSRF).\n\n## Solution\n\nMettre Moodle \u00e0 jour en version 1.8.11 ou 1.9.7 (cf. section\nDocumentation).\n",
  "cves": [],
  "initial_release_date": "2009-12-14T00:00:00",
  "last_revision_date": "2009-12-14T00:00:00",
  "links": [
    {
      "title": "T\u00e9l\u00e9chargement des versions 1.8.11 et 1.9.7 de Moodle :",
      "url": "http://download.moodle.org/"
    },
    {
      "title": "Bulletins de s\u00e9curit\u00e9 Moodle MSA-09-022 \u00e0 MSA-09-031 du 02    d\u00e9cembre 2009 :",
      "url": "http://moodle.org/security/"
    }
  ],
  "reference": "CERTA-2009-AVI-545",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2009-12-14T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Injection de requ\u00eates ill\u00e9gitimes par rebond (CSRF)"
    },
    {
      "description": "Acc\u00e8s non autoris\u00e9"
    },
    {
      "description": "Injection SQL"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s dans \u003cspan class=\"textit\"\u003eMoodle\u003c/span\u003e\npermettent notamment de se connecter en tant qu\u0027administrateur.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans Moodle",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletins de s\u00e9curit\u00e9 Moodle MSA-09-022 \u00e0 MSA-09-031 du 02 d\u00e9cembre 2009",
      "url": null
    }
  ]
}