DeutschIn der Originalsprache angezeigt — eine vollständige Übersetzung ist für eine zukünftige Version geplant.
Moodle: Mehrere Schwachstellen
Advisory ansehen veröffentlicht 2023-03-06
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Moodle ausnutzen, um beliebigen Programmcode auszuführen, Informationen offenzulegen, Dateien zu manipulieren, Sicherheitsvorkehrungen zu umgehen oder einen Cross-Site-Scripting-Angriff durchzuführen.
01
beschreibt (12)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2021-36403US | medium5.3 | — | ||
In Moodle, in some circumstances, email notifications of messages could have the link back to the original message hidden by HTML, which may pose a phishing risk. | ||||
| CVE-2021-36402US | medium5.3 | — | ||
In Moodle, Users' names required additional sanitizing in the account confirmation email, to prevent a self-registration phishing risk. | ||||
| CVE-2021-36401US | medium4.8 | — | ||
In Moodle, ID numbers exported in HTML data formats required additional sanitizing to prevent a local stored XSS risk. | ||||
| CVE-2021-36400US | medium5.3OT erhöht | — | ||
In Moodle, insufficient capability checks made it possible to remove other users' calendar URL subscriptions. | ||||
| CVE-2021-36399US | medium5.4 | — | ||
In Moodle, ID numbers displayed in the quiz override screens required additional sanitizing to prevent a stored XSS risk. | ||||
| CVE-2021-36398US | medium5.4 | — | ||
In moodle, ID numbers displayed in the web service token list required additional sanitizing to prevent a stored XSS risk. | ||||
| CVE-2021-36397US | medium5.3OT erhöht | — | ||
In Moodle, insufficient capability checks meant message deletions were not limited to the current user. | ||||
| CVE-2021-36396US | high7.5 | Exploit | ||
In Moodle, insufficient redirect handling made it possible to blindly bypass cURL blocked hosts/allowed ports restrictions, resulting in a blind SSRF risk. | ||||
| CVE-2021-36395US | high7.5 | — | ||
In Moodle, the file repository's URL parsing required additional recursion handling to mitigate the risk of recursion denial of service. | ||||
| CVE-2021-36394US | critical9.8 | Exploit | ||
In Moodle, a remote code execution risk was identified in the Shibboleth authentication plugin. | ||||
| CVE-2021-36393US | critical9.8 | Exploit | ||
In Moodle, an SQL injection risk was identified in the library fetching a user's recent courses. | ||||
| CVE-2021-36392US | critical9.8 | — | ||
In Moodle, an SQL injection risk was identified in the library fetching a user's enrolled courses. | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- Moodle Security announcement vom 2023-03-06external
- Moodle Security announcement vom 2023-03-06external
- Moodle Security announcement vom 2023-03-06external
- Moodle Security announcement vom 2023-03-06external
- Moodle Security announcement vom 2023-03-06external
- Moodle Security announcement vom 2023-03-06external
- Moodle Security announcement vom 2023-03-06external
- Moodle Security announcement vom 2023-03-06external
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan