Skip to content
OpenAdvisories
Medium WID-SEC-2024-0420 6 CVEs

Moodle: Mehrere Schwachstellen

Published Feb 19, 2024 · Updated Feb 20, 2024 · Revision 2 · de-DE

Vendor: Fedora Product: Linux Platform: Linux Platform: macOS Platform: Windows

Summary

Ein entfernter Angreifer kann mehrere Schwachstellen in Moodle ausnutzen, um einen Denial-of-Service-Zustand zu verursachen, vertrauliche Informationen offenzulegen oder Dateien zu manipulieren.

Product

Moodle ist ein Software-Paket, um internetbasierte Kurse zu entwickeln und durchzuführen. Es ist ein globales Softwareentwicklungsprojekt, das einen konstruktivistischen Lehr- und Lernansatz unterstützt.

Vulnerabilities 6

  • High 7.5
    CVE-2024-25978

    Msa-24-0001: denial of service risk in file picker unzip functionality

    Insufficient file size checks resulted in a denial of service risk in the file picker's unzip functionality.

    moodle/moodle moodle Web / CMS Ubuntu Packagist
  • Medium 5.3
    CVE-2024-25979

    Msa-24-0002: forum search accepted random parameters in its url

    The URL parameters accepted by forum search were not limited to the allowed parameters.

    moodle/moodle moodle Web / CMS Ubuntu Packagist
  • Medium 4.3
    CVE-2024-25980

    Msa-24-0003: h5p attempts report did not respect activity group settings

    Separate Groups mode restrictions were not honored in the H5P attempts report, which would display users from other groups. By default this only provided additional access to non-editing teachers.

    moodle/moodle moodle Web / CMS Ubuntu Packagist
  • Medium 4.3
    CVE-2024-25981

    Msa-24-0004: forum export did not respect activity group settings

    Separate Groups mode restrictions were not honored when performing a forum export, which would export forum data for all groups. By default this only provided additional access to non-editing teachers.

    moodle/moodle moodle Web / CMS Ubuntu Packagist
  • Medium 4.3
    CVE-2024-25982

    Msa-24-0005: csrf risk in language import utility

    The link to update all installed language packs did not include the necessary token to prevent a CSRF risk.

    moodle/moodle moodle Web / CMS Ubuntu Packagist
  • Low 3.5
    CVE-2024-25983

    Msa-24-0006: idor on dashboard comments block

    Insufficient checks in a web service made it possible to add comments to the comments block on another user's dashboard when it was not otherwise available (e.g., on their profile page).

    moodle/moodle moodle Web / CMS Ubuntu Packagist

Revision history

  1. #2

    Neue Updates von Fedora aufgenommen

  2. #1

    Initiale Fassung

References