Summary
Ein Angreifer kann mehrere Schwachstellen in Moodle ausnutzen, um SQL-Injection- und Cross-Site-Scripting-Angriffe durchzuführen, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen preiszugeben oder andere nicht näher spezifizierte Auswirkungen zu verursachen.
Product
Moodle ist ein Software-Paket, um internetbasierte Kurse zu entwickeln und durchzuführen. Es ist ein globales Softwareentwicklungsprojekt, das einen konstruktivistischen Lehr- und Lernansatz unterstützt.
Vulnerabilities 9
-
High 8.6
Arbitrary file read risk through pdfTeX
Insufficient sanitizing in the TeX notation filter resulted in an arbitrary file read risk on sites where pdfTeX is available (such as those with TeX Live installed).
-
High 8.3CVE-2025-26529 Public exploit
Stored XSS risk in admin live log
Description information displayed in the site administration live log required additional sanitizing to prevent a stored XSS risk.
-
High 8.3
Reflected XSS via question bank filter
The question bank filter required additional sanitizing to prevent a reflected XSS risk.
-
High 8.1
SQL injection risk in course search module list filter
An SQL injection risk was identified in the module list filter within course search.
-
Medium 6.5
Feedback response viewing and deletions did not respect Separate Groups mode
Separate Groups mode restrictions were not factored into permission checks before allowing viewing or deletion of responses in Feedback activities.
-
Medium 5.3
Non-searchable tags can still be discovered on the tag search page and in the tags block
Tags not expected to be visible to a user could still be discovered by them via the tag search page or in the tags block.
-
Low 3.4
Stored XSS in ddimageortext question type
The drag-and-drop onto image (ddimageortext) question type required additional sanitizing to prevent a stored XSS risk.
-
Low 3.1
IDOR in badges allows disabling of arbitrary badges
Insufficient capability checks made it possible to disable badges a user does not have permission to access.
-
Low 3.1
Teachers can evade trusttext config when restoring glossary entries
Additional checks were required to ensure trusttext is applied (when enabled) to glossary entries being restored.
Revision history
-
#1
Initiale Fassung
References
-
Moodle Security announcements vom 2025-02-17
https://moodle.org/mod/forum/discuss.php?d=466141
-
Moodle Security announcements vom 2025-02-17
https://moodle.org/mod/forum/discuss.php?d=466142
-
Moodle Security announcements vom 2025-02-17
https://moodle.org/mod/forum/discuss.php?d=466143
-
Moodle Security announcements vom 2025-02-17
https://moodle.org/mod/forum/discuss.php?d=466144
-
Moodle Security announcements vom 2025-02-17
https://moodle.org/mod/forum/discuss.php?d=466145
-
Moodle Security announcements vom 2025-02-17
https://moodle.org/mod/forum/discuss.php?d=466146
-
Moodle Security announcements vom 2025-02-17
https://moodle.org/mod/forum/discuss.php?d=466147
-
Moodle Security announcements vom 2025-02-17
https://moodle.org/mod/forum/discuss.php?d=466148
-
Moodle Security announcements vom 2025-02-17
https://moodle.org/mod/forum/discuss.php?d=466149
-
Moodle Security announcements vom 2025-02-17
https://moodle.org/mod/forum/discuss.php?d=466150