DeutschShown in its original language — a full translation is planned for a future version.
Moodle: Mehrere Schwachstellen
view advisory published 2023-10-17
Ein Angreifer kann mehrere Schwachstellen in Moodle ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Informationen offenzulegen oder einen Cross-Site-Scripting-Angriff durchzuführen.
01
describes (10)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2023-5543US | low3.3 | — | ||
When duplicating a BigBlueButton activity, the original meeting ID was also duplicated instead of using a new ID for the new activity. This could provide unintended access to the o… | ||||
| CVE-2023-5551US | low3.3 | — | ||
Separate Groups mode restrictions were not honoured in the forum summary report, which would display users from other groups. | ||||
| CVE-2023-5550US | critical9.8 | — | ||
In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user who also has direct access to the web server outside of the Moodl… | ||||
| CVE-2023-5549US | medium5.3 | — | ||
Insufficient web service capability checks made it possible to move categories a user had permission to manage, to a parent category they did not have the capability to manage. | ||||
| CVE-2023-5548US | medium5.3OT elevated | — | ||
Stronger revision number limitations were required on file serving endpoints to improve cache poisoning protection. | ||||
| CVE-2023-5547US | medium6.1 | — | ||
The course upload preview contained an XSS risk for users uploading unsafe data. | ||||
| CVE-2023-5546US | medium5.4 | Exploit | ||
ID numbers displayed in the quiz grading report required additional sanitizing to prevent a stored XSS risk. | ||||
| CVE-2023-5545US | medium5.3 | — | ||
H5P metadata automatically populated the author with the user's username, which could be sensitive information. | ||||
| CVE-2023-5544US | medium5.4 | — | ||
Wiki comments required additional sanitizing and access restrictions to prevent a stored XSS risk and potential IDOR risk. | ||||
| CVE-2023-5542US | medium4.3 | — | ||
Students in "Only see own membership" groups could see other students in the group, which should be hidden. | ||||
02
references
External citations — patches, advisories, analysis.
- Moodle Security announcement vom 2023-10-17external
- Moodle Security announcement vom 2023-10-17external
- Moodle Security announcement vom 2023-10-17external
- Moodle Security announcement vom 2023-10-17external
- Moodle Security announcement vom 2023-10-17external
- Moodle Security announcement vom 2023-10-17external
- Moodle Security announcement vom 2023-10-17external
- Moodle Security announcement vom 2023-10-17external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan