Skip to content
OpenAdvisories
High WID-SEC-2023-0696 10 CVEs

Moodle: Mehrere Schwachstellen

Published Mar 20, 2023 · Updated Mar 21, 2023 · Revision 2 · de-DE

Vendor: Fedora Product: Linux Platform: Linux Platform: Windows

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Moodle ausnutzen, um einen Cross-Site-Scripting-Angriff durchzuführen, Informationen offenzulegen, Dateien zu manipulieren oder Sicherheitsvorkehrungen zu umgehen.

Product

Moodle ist ein Software-Paket, um internetbasierte Kurse zu entwickeln und durchzuführen. Es ist ein globales Softwareentwicklungsprojekt, das einen konstruktivistischen Lehr- und Lernansatz unterstützt.

Vulnerabilities 10

  • Critical 9.8
    CVE-2023-28333

    Moodle: pix helper potential mustache code injection risk

    The Mustache pix helper contained a potential Mustache injection risk if combined with user input (note: This did not appear to be implemented/exploitable anywhere in the core Moodle LMS).

    moodle/moodle moodle Web / CMS Ubuntu Packagist
  • High 8.8
    CVE-2023-28335

    Moodle: csrf risk in resetting all templates of a database activity

    The link to reset all templates of a database activity did not include the necessary token to prevent a CSRF risk.

    moodle/moodle moodle Web / CMS Ubuntu Packagist
  • Medium 6.5
    CVE-2023-28330

    Moodle: authenticated arbitrary file read through malformed backup file

    Insufficient sanitizing in backup resulted in an arbitrary file read risk. The capability to access this feature is only available to teachers, managers and admins by default.

    moodle/moodle moodle Web / CMS Ubuntu Packagist
  • Medium 6.3
    CVE-2023-28329

    Moodle: authenticated sql injection via availability check

    Insufficient validation of profile field availability condition resulted in an SQL injection risk (by default only available to teachers and managers).

    moodle/moodle moodle Web / CMS Ubuntu Packagist
  • Medium 6.1
    CVE-2023-28331

    Moodle: xss risk when outputting database activity filter data

    Content output by the database auto-linking filter required additional sanitizing to prevent an XSS risk.

    moodle/moodle moodle Web / CMS Ubuntu Packagist
  • Medium 6.1
    CVE-2023-28332

    Moodle: algebra filter xss when filter is misconfigured

    If the algebra filter was enabled but not functional (eg the necessary binaries were missing from the server), it presented an XSS risk.

    moodle/moodle moodle Web / CMS Ubuntu Packagist
  • Medium 5.4
    CVE-2022-23494

    Cross-site scripting vulnerability in TinyMCE alerts

    tinymce is an open source rich text editor. A cross-site scripting (XSS) vulnerability was discovered in the alert and confirm dialogs when these dialogs were provided with malicious HTML content. This can occur in plugins that use the alert or confirm dialog…

    tinymce tinymce tinymce tinymce Ubuntu npm Packagist NuGet
  • Medium 4.3
    CVE-2023-1402

    Moodle: course participation report shows roles the user should not see

    The course participation report required additional checks to prevent roles being displayed which the user did not have access to view.

    moodle/moodle moodle Web / CMS Ubuntu Packagist
  • Medium 4.3
    CVE-2023-28334

    Moodle: users' name enumeration possible via idor on learning plans page

    Authenticated users were able to enumerate other users' names via the learning plans page.

    moodle/moodle moodle Web / CMS Ubuntu Packagist
  • Medium 4.3
    CVE-2023-28336

    Moodle: teacher can access names of users they do not have permission to access

    Insufficient filtering of grade report history made it possible for teachers to access the names of users they could not otherwise access.

    moodle/moodle moodle Web / CMS Ubuntu Packagist

Revision history

  1. #2

    Neue Updates von Fedora aufgenommen

  2. #1

    Initiale Fassung

References