Skip to content
OpenAdvisories
Medium WID-SEC-2024-3177 6 CVEs

Moodle: Mehrere Schwachstellen ermöglichen Umgehen von Sicherheitsvorkehrungen und die Offenlegung von Informationen

Published Oct 14, 2024 · Updated Oct 14, 2024 · de-DE

Platform: Windows

Summary

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Moodle ausnutzen, um Sicherheitsvorkehrungen zu umgehen und vertrauliche Informationen offenzulegen.

Product

Moodle ist ein Software-Paket, um internetbasierte Kurse zu entwickeln und durchzuführen. Es ist ein globales Softwareentwicklungsprojekt, das einen konstruktivistischen Lehr- und Lernansatz unterstützt.

Vulnerabilities 6

  • Medium 6.5
    CVE-2024-48897

    Moodle: idor in edit/delete rss feed

    A vulnerability was found in Moodle. Additional checks are required to ensure users can only edit or delete RSS feeds that they have permission to modify.

    moodle/moodle moodle Web / CMS Ubuntu Packagist
  • Medium 6.5
    CVE-2024-48898

    Moodle: some users can delete audiences of other reports

    A vulnerability was found in Moodle. Users with access to delete audiences from reports could delete audiences from other reports that they do not have permission to delete from.

    moodle/moodle moodle Web / CMS Ubuntu Packagist
  • Medium 4.3
    CVE-2024-48896

    Moodle: users' names returned in messaging error message

    A vulnerability was found in Moodle. It is possible for users with the "send message" capability to view other users' names that they may not otherwise have access to via an error message in Messaging. Note: The name returned follows the full name format conf…

    moodle/moodle moodle Web / CMS Ubuntu Packagist
  • Medium 4.3
    CVE-2024-48899

    Moodle: idor when accessing list of course badges

    A vulnerability was found in Moodle. Additional checks are required to ensure users can only fetch the list of course badges for courses that they are intended to have access to.

    moodle/moodle moodle Web / CMS Ubuntu Packagist
  • Medium 4.3
    CVE-2024-48900

    Moodle: idor when accessing list of badge recipients

    A vulnerability was found in Moodle. Additional checks are required to ensure users with permission to view badge recipients can only access lists of those they are intended to have access to.

    moodle/moodle Web / CMS Packagist
  • Medium 4.3
    CVE-2024-48901

    Moodle: idor when fetching report schedules

    A vulnerability was found in Moodle. Additional checks are required to ensure users can only access the schedule of a report if they have permission to edit that report.

    moodle/moodle moodle Web / CMS Ubuntu Packagist

Revision history

  1. #1

    Initiale Fassung

References