Summary
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Moodle ausnutzen, um beliebigen Programmcode auszuführen, Informationen offenzulegen, Dateien zu manipulieren, Sicherheitsvorkehrungen zu umgehen oder einen Cross-Site-Scripting-Angriff durchzuführen.
Product
Moodle ist ein Software-Paket, um internetbasierte Kurse zu entwickeln und durchzuführen. Es ist ein globales Softwareentwicklungsprojekt, das einen konstruktivistischen Lehr- und Lernansatz unterstützt.
Vulnerabilities 12
-
Critical 9.8
Moodle SQL Injection vulnerability
In Moodle, an SQL injection risk was identified in the library fetching a user's enrolled courses.
-
Critical 9.8
Moodle SQL Injection vulnerability
In Moodle, an SQL injection risk was identified in the library fetching a user's recent courses.
-
Critical 9.8CVE-2021-36394 Public exploit
Moodle Session Fixation vulnerability
In Moodle, a remote code execution risk was identified in the Shibboleth authentication plugin.
-
High 7.5
Moodle vulnerable to Uncontrolled Resource Consumption
In Moodle, the file repository's URL parsing required additional recursion handling to mitigate the risk of recursion denial of service.
-
High 7.5CVE-2021-36396 Public exploit
Moodle vulnerable to Server-Side Request Forgery
In Moodle, insufficient redirect handling made it possible to blindly bypass cURL blocked hosts/allowed ports restrictions, resulting in a blind SSRF risk.
-
Medium 5.4
Moodle Cross-site Scripting vulnerability
In moodle, ID numbers displayed in the web service token list required additional sanitizing to prevent a stored XSS risk.
-
Medium 5.4
Moodle Cross-site Scripting vulnerability
In Moodle, ID numbers displayed in the quiz override screens required additional sanitizing to prevent a stored XSS risk.
-
Medium 5.3
Moodle has Incorrect Default Permissions
In Moodle, insufficient capability checks meant message deletions were not limited to the current user.
-
Medium 5.3
Moodle has Incorrect Default Permissions
In Moodle, insufficient capability checks made it possible to remove other users' calendar URL subscriptions.
-
Medium 5.3
Moodle Improper Input Validation vulnerability
In Moodle, Users' names required additional sanitizing in the account confirmation email, to prevent a self-registration phishing risk.
-
Medium 5.3
Moodle has a Hidden Functionality vulnerability
In Moodle, in some circumstances, email notifications of messages could have the link back to the original message hidden by HTML, which may pose a phishing risk.
-
Medium 4.8
Moodle vulnerable to Stored Cross-site Scripting
In Moodle, ID numbers exported in HTML data formats required additional sanitizing to prevent a local stored XSS risk.
Revision history
-
#1
Initiale Fassung
References
-
Moodle Security announcement vom 2023-03-06
https://moodle.org/mod/forum/discuss.php?d=424809
-
Moodle Security announcement vom 2023-03-06
https://moodle.org/mod/forum/discuss.php?d=424808
-
Moodle Security announcement vom 2023-03-06
https://moodle.org/mod/forum/discuss.php?d=424807
-
Moodle Security announcement vom 2023-03-06
https://moodle.org/mod/forum/discuss.php?d=424806
-
Moodle Security announcement vom 2023-03-06
https://moodle.org/mod/forum/discuss.php?d=424805
-
Moodle Security announcement vom 2023-03-06
https://moodle.org/mod/forum/discuss.php?d=424804
-
Moodle Security announcement vom 2023-03-06
https://moodle.org/mod/forum/discuss.php?d=424803
-
Moodle Security announcement vom 2023-03-06
https://moodle.org/mod/forum/discuss.php?d=424802
-
Moodle Security announcement vom 2023-03-06
https://moodle.org/mod/forum/discuss.php?d=424801
-
Moodle Security announcement vom 2023-03-06
https://moodle.org/mod/forum/discuss.php?d=424799
-
Moodle Security announcement vom 2023-03-06
https://moodle.org/mod/forum/discuss.php?d=424798
-
Moodle Security announcement vom 2023-03-06
https://moodle.org/mod/forum/discuss.php?d=424797