DeutschIn der Originalsprache angezeigt — eine vollständige Übersetzung ist für eine zukünftige Version geplant.
Moodle: Mehrere Schwachstellen
Advisory ansehen veröffentlicht 2025-04-21
Ein Angreifer kann mehrere Schwachstellen in Moodle ausnutzen, um beliebigen Code auszuführen, einen Denial-of Service zu verursachen, Informationen offenzulegen, Cross-Site-Scripting durchzuführen und weitere nicht näher spezifizierte Auswirkungen zu verursachen.
01
beschreibt (16)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2025-3647US | —OT erhöht | — | ||
A flaw was discovered in Moodle. Additional checks were required to ensure that users can only access cohort data they are authorized to retrieve. | ||||
| CVE-2025-3645US | —OT erhöht | — | ||
A flaw was found in Moodle. Insufficient capability checks in a messaging web service allowed users to view other users' names and online statuses. | ||||
| CVE-2025-3644US | —OT erhöht | — | ||
A flaw was found in Moodle. Additional checks were required to prevent users from deleting course sections they did not have permission to modify. | ||||
| CVE-2025-3643US | — | — | ||
A flaw was found in Moodle. The return URL in the policy tool required additional sanitizing to prevent a reflected Cross-site scripting (XSS) risk. | ||||
| CVE-2025-3642US | — | — | ||
A flaw was found in Moodle. A remote code execution risk was identified in the Moodle LMS EQUELLA repository. By default, this was only available to teachers and managers on sites… | ||||
| CVE-2025-3641US | — | — | ||
A flaw was found in Moodle. A remote code execution risk was identified in the Moodle LMS Dropbox repository. By default, this was only available to teachers and managers on sites… | ||||
| CVE-2025-3640US | — | — | ||
A flaw was found in Moodle. Insufficient capability checks made it possible for a user enrolled in a course to access some details, such as the full name and profile image URL, of… | ||||
| CVE-2025-3638US | — | — | ||
A flaw was found in Moodle. The analysis request action in the Brickfield tool did not include the necessary token to prevent a Cross-site request forgery (CSRF) risk. | ||||
| CVE-2025-3637US | — | — | ||
A security vulnerability was found in Moodle where confidential information that prevents cross-site request forgery (CSRF) attacks was shared publicly through the site's URL. This… | ||||
| CVE-2025-3636US | — | — | ||
A flaw was found in Moodle. This vulnerability allows unauthorized users to access and view RSS feeds due to insufficient capability checks. | ||||
| CVE-2025-3635US | — | — | ||
A security vulnerability was discovered in Moodle that allows anyone to duplicate existing tours without needing to log in due to a lack of protection against cross-site request fo… | ||||
| CVE-2025-3628US | — | — | ||
A flaw has was found in Moodle where anonymous assignment submissions can be de-anonymized via search, revealing student identities. | ||||
| CVE-2025-3627US | — | — | ||
A security vulnerability was discovered in Moodle that allows some users to access sensitive information about other students before they finish verifying their identities using tw… | ||||
| CVE-2025-3625US | — | — | ||
A security vulnerability was discovered in Moodle that can allow hackers to gain access to sensitive information about students and prevent them from logging into their accounts, e… | ||||
| CVE-2025-3634US | — | — | ||
A security vulnerability was discovered in Moodle that allows students to enroll themselves in courses without completing all the necessary safety checks. Specifically, users can s… | ||||
| CVE-2024-40446US | — | — | ||
An issue in forkosh Mime Tex before v.1.77 allows an attacker to execute arbitrary code via a crafted script | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- Moodle Security Advisory MSA-25-0013 vom 2025-04-21external
- Moodle Security Advisory MSA-25-0014 vom 2025-04-21external
- Moodle Security Advisory MSA-25-0015 vom 2025-04-21external
- Moodle Security Advisory MSA-25-0016 vom 2025-04-21external
- Moodle Security Advisory MSA-25-0017 vom 2025-04-21external
- Moodle Security Advisory MSA-25-0018 vom 2025-04-21external
- Moodle Security Advisory MSA-25-0019 vom 2025-04-21external
- Moodle Security Advisory MSA-25-0020 vom 2025-04-21external
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan