DeutschShown in its original language — a full translation is planned for a future version.
Moodle: Mehrere Schwachstellen
view advisory published 2023-03-06
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Moodle ausnutzen, um beliebigen Programmcode auszuführen, Informationen offenzulegen, Dateien zu manipulieren, Sicherheitsvorkehrungen zu umgehen oder einen Cross-Site-Scripting-Angriff durchzuführen.
01
describes (12)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2021-36403US | medium5.3 | — | ||
In Moodle, in some circumstances, email notifications of messages could have the link back to the original message hidden by HTML, which may pose a phishing risk. | ||||
| CVE-2021-36402US | medium5.3 | — | ||
In Moodle, Users' names required additional sanitizing in the account confirmation email, to prevent a self-registration phishing risk. | ||||
| CVE-2021-36401US | medium4.8 | — | ||
In Moodle, ID numbers exported in HTML data formats required additional sanitizing to prevent a local stored XSS risk. | ||||
| CVE-2021-36400US | medium5.3OT elevated | — | ||
In Moodle, insufficient capability checks made it possible to remove other users' calendar URL subscriptions. | ||||
| CVE-2021-36399US | medium5.4 | — | ||
In Moodle, ID numbers displayed in the quiz override screens required additional sanitizing to prevent a stored XSS risk. | ||||
| CVE-2021-36398US | medium5.4 | — | ||
In moodle, ID numbers displayed in the web service token list required additional sanitizing to prevent a stored XSS risk. | ||||
| CVE-2021-36397US | medium5.3OT elevated | — | ||
In Moodle, insufficient capability checks meant message deletions were not limited to the current user. | ||||
| CVE-2021-36396US | high7.5 | Exploit | ||
In Moodle, insufficient redirect handling made it possible to blindly bypass cURL blocked hosts/allowed ports restrictions, resulting in a blind SSRF risk. | ||||
| CVE-2021-36395US | high7.5 | — | ||
In Moodle, the file repository's URL parsing required additional recursion handling to mitigate the risk of recursion denial of service. | ||||
| CVE-2021-36394US | critical9.8 | Exploit | ||
In Moodle, a remote code execution risk was identified in the Shibboleth authentication plugin. | ||||
| CVE-2021-36393US | critical9.8 | Exploit | ||
In Moodle, an SQL injection risk was identified in the library fetching a user's recent courses. | ||||
| CVE-2021-36392US | critical9.8 | — | ||
In Moodle, an SQL injection risk was identified in the library fetching a user's enrolled courses. | ||||
02
references
External citations — patches, advisories, analysis.
- Moodle Security announcement vom 2023-03-06external
- Moodle Security announcement vom 2023-03-06external
- Moodle Security announcement vom 2023-03-06external
- Moodle Security announcement vom 2023-03-06external
- Moodle Security announcement vom 2023-03-06external
- Moodle Security announcement vom 2023-03-06external
- Moodle Security announcement vom 2023-03-06external
- Moodle Security announcement vom 2023-03-06external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan