DeutschShown in its original language — a full translation is planned for a future version.
Moodle: Mehrere Schwachstellen
view advisory published 2024-05-12
Ein entfernter Angreifer kann mehrere Schwachstellen in Moodle ausnutzen, um beliebigen Code auszuführen, ReCAPTCHA zu umgehen, vertrauliche Informationen offenzulegen oder einen Cross-Site Scripting (XSS)-Angriff durchzuführen.
01
describes (14)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2024-34009US | — | — | ||
Insufficient checks whether ReCAPTCHA was enabled made it possible to bypass the checks on the login page. This did not affect other pages where ReCAPTCHA is utilized. | ||||
| CVE-2024-34008US | high8.8 | — | ||
Actions in the admin management of analytics models did not include the necessary token to prevent a CSRF risk. | ||||
| CVE-2024-34007US | — | — | ||
The logout option within MFA did not include the necessary token to avoid the risk of users inadvertently being logged out via CSRF. | ||||
| CVE-2024-34006US | — | — | ||
The site log report required additional encoding of event descriptions to ensure any HTML in the content is displayed in plaintext instead of being rendered. | ||||
| CVE-2024-34005US | — | — | ||
In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user with both access to restore database activity modules and direct… | ||||
| CVE-2024-34004US | — | — | ||
In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user with both access to restore wiki modules and direct access to the… | ||||
| CVE-2024-34003US | — | — | ||
In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user with both access to restore workshop modules and direct access to… | ||||
| CVE-2024-34002US | — | — | ||
In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user with both access to restore feedback modules and direct access to… | ||||
| CVE-2024-34001US | — | — | ||
Actions in the admin preset tool did not include the necessary token to prevent a CSRF risk. | ||||
| CVE-2024-34000US | — | — | ||
ID numbers displayed in the lesson overview report required additional sanitizing to prevent a stored XSS risk. | ||||
| CVE-2024-33999US | — | — | ||
The referrer URL used by MFA required additional sanitizing, rather than being used directly. | ||||
| CVE-2024-33998US | — | — | ||
Insufficient escaping of participants' names in the participants page table resulted in a stored XSS risk when interacting with some features. | ||||
| CVE-2024-33997US | — | — | ||
Additional sanitizing was required when opening the equation editor to prevent a stored XSS risk when editing another user's equation. | ||||
| CVE-2024-33996US | — | — | ||
Incorrect validation of allowed event types in a calendar web service made it possible for some users to create events with types/audiences they did not have permission to publish… | ||||
02
references
External citations — patches, advisories, analysis.
- Moodle Security Advisory MSA-24-0011 vom 2024-05-12external
- Moodle Security Advisory MSA-24-0012 vom 2024-05-12external
- Moodle Security Advisory MSA-24-0013 vom 2024-05-12external
- Moodle Security Advisory MSA-24-0014 vom 2024-05-12external
- Moodle Security Advisory MSA-24-0015 vom 2024-05-12external
- Moodle Security Advisory MSA-24-0016 vom 2024-05-12external
- Moodle Security Advisory MSA-24-0017 vom 2024-05-12external
- Moodle Security Advisory MSA-24-0018 vom 2024-05-12external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan