Skip to content
OpenAdvisories
High WID-SEC-2023-2701 10 CVEs

Moodle: Mehrere Schwachstellen

Published Oct 17, 2023 · Updated Oct 17, 2023 · de-DE

Platform: Linux Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in Moodle ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Informationen offenzulegen oder einen Cross-Site-Scripting-Angriff durchzuführen.

Product

Moodle ist ein Software-Paket, um internetbasierte Kurse zu entwickeln und durchzuführen. Es ist ein globales Softwareentwicklungsprojekt, das einen konstruktivistischen Lehr- und Lernansatz unterstützt.

Vulnerabilities 10

  • Medium 6.5
    CVE-2023-5544

    Moodle: stored xss and potential idor risk in wiki comments

    Wiki comments required additional sanitizing and access restrictions to prevent a stored XSS risk and potential IDOR risk.

    moodle/moodle moodle Web / CMS Ubuntu Packagist
  • Medium 6.5
    CVE-2023-5550

    Moodle: rce due to lfi risk in some misconfigured shared hosting environments

    In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user who also has direct access to the web server outside of the Moodle webroot could utilise a local file include to achieve remote code execution.

    moodle/moodle moodle Web / CMS Ubuntu Packagist
  • Medium 4.3
    CVE-2023-5546 Public exploit

    Moodle: stored xss in quiz grading report via user id number

    ID numbers displayed in the quiz grading report required additional sanitizing to prevent a stored XSS risk.

    moodle/moodle moodle Web / CMS Ubuntu Packagist
  • Low 3.3
    CVE-2023-5542

    Moodle: students can view other users in "only see own membership" groups

    Students in "Only see own membership" groups could see other students in the group, which should be hidden.

    moodle/moodle moodle Web / CMS Ubuntu Packagist
  • Low 3.3
    CVE-2023-5543

    Moodle: duplicating a bigbluebutton activity assigns the same meeting id

    When duplicating a BigBlueButton activity, the original meeting ID was also duplicated instead of using a new ID for the new activity. This could provide unintended access to the original meeting.

    moodle Web / CMS Ubuntu
  • Low 3.3
    CVE-2023-5545

    Moodle: auto-populated h5p author name causes a potential information leak

    H5P metadata automatically populated the author with the user's username, which could be sensitive information.

    moodle/moodle moodle Web / CMS Ubuntu Packagist
  • Low 3.3
    CVE-2023-5547

    Moodle: xss risk when previewing data in course upload tool

    The course upload preview contained an XSS risk for users uploading unsafe data.

    moodle/moodle moodle Web / CMS Ubuntu Packagist
  • Low 3.3
    CVE-2023-5548

    Moodle: cache poisoning risk with endpoint revision numbers

    Stronger revision number limitations were required on file serving endpoints to improve cache poisoning protection.

    moodle/moodle moodle Web / CMS Ubuntu Packagist
  • Low 3.3
    CVE-2023-5549

    Moodle: insufficient capability checks when updating the parent of a course category

    Insufficient web service capability checks made it possible to move categories a user had permission to manage, to a parent category they did not have the capability to manage.

    moodle/moodle moodle Web / CMS Ubuntu Packagist
  • Low 3.3
    CVE-2023-5551

    Moodle: forum summary report shows students from other groups when in separate groups mode

    Separate Groups mode restrictions were not honoured in the forum summary report, which would display users from other groups.

    moodle/moodle moodle Web / CMS Ubuntu Packagist

Revision history

  1. #1

    Initiale Fassung

References