Skip to content
OpenAdvisories
Medium WID-SEC-2023-0248 3 CVEs

Moodle: Mehrere Schwachstellen

Published Jan 31, 2023 · Updated Jan 31, 2023 · de-DE

Platform: Linux Platform: Windows

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Moodle ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen und Einstellungen zu manipulieren.

Product

Moodle ist ein Software-Paket, um internetbasierte Kurse zu entwickeln und durchzuführen. Es ist ein globales Softwareentwicklungsprojekt, das einen konstruktivistischen Lehr- und Lernansatz unterstützt.

Vulnerabilities 3

  • High 8.2
    CVE-2023-23923

    Moodle: possible to set the preferred "start page" of other users

    The vulnerability was found Moodle which exists due to insufficient limitations on the "start page" preference. A remote attacker can set that preference for another user. The vulnerability allows a remote attacker to gain unauthorized access to otherwise res…

    moodle/moodle moodle Web / CMS Ubuntu Packagist
  • Medium 6.1
    CVE-2023-23921

    Moodle: reflected xss risk in some returnurl parameters

    The vulnerability was found Moodle which exists due to insufficient sanitization of user-supplied data in some returnurl parameters. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's…

    moodle/moodle moodle Web / CMS Ubuntu Packagist
  • Medium 6.1
    CVE-2023-23922

    Moodle: reflected xss risk in blog search

    The vulnerability was found Moodle which exists due to insufficient sanitization of user-supplied data in blog search. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in co…

    moodle/moodle moodle Web / CMS Ubuntu Packagist

Revision history

  1. #1

    Initiale Fassung

References