Security announcements

MSA-26-0041: CSRF risk in XML grade imports

от Michael Hawkins -

The XML grade import functionality (which allows setting or overwriting of student grades) did not include the necessary token to prevent a CSRF risk.

Severity/Risk: Serious
Versions affected: 5.2 to 5.2.1, 5.1 to 5.1.5, 5.0 to 5.0.8, 4.5 to 4.5.12 and earlier unsupported versions
Versions fixed: 5.2.2, 5.1.6, 5.0.9 and 4.5.13
Reported by: Vincent Schneider
CVE identifier: Pending (details will be updated once available)
Changes (main): http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-84545
Tracker issue: MDL-84545 CSRF risk in XML grade imports
Обсъждане по темата  (0 отговора до сега)

MSA-26-0040: User list filters do not respect user profile field visibility

от Michael Hawkins -

User list filters allowed managers to filter by user profile fields that they could not view on users' profiles.

Severity/Risk: Minor
Versions affected: 5.2 to 5.2.1, 5.1 to 5.1.5, 5.0 to 5.0.8, 4.5 to 4.5.12 and earlier unsupported versions
Versions fixed: 5.2.2, 5.1.6, 5.0.9 and 4.5.13
Reported by: Martin Greenaway
CVE identifier: Pending (details will be updated once available)
Changes (main): http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-87518
Tracker issue: MDL-87518 User list filters do not respect user profile field visibility
Обсъждане по темата  (0 отговора до сега)

MSA-26-0039: Minor XSS risk via password reset link

от Michael Hawkins -

Insufficient username escaping could allow a minor XSS risk if an unauthenticated user was tricked into opening a password reset link (so did not affect authenticated user sessions).

Severity/Risk: Minor
Versions affected: 5.2 to 5.2.1, 5.1 to 5.1.5, 5.0 to 5.0.8, 4.5 to 4.5.12 and earlier unsupported versions
Versions fixed: 5.2.2, 5.1.6, 5.0.9 and 4.5.13
Reported by: Henk van den Toorn
CVE identifier: Pending (details will be updated once available)
Changes (main): http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-88335
Tracker issue: MDL-88335 Minor XSS risk via password reset link
Обсъждане по темата  (0 отговора до сега)

MSA-26-0038: Enrolling user to course while selecting group does not validate group belongs to that course

от Michael Hawkins -

A check to validate a group belonged to a course was missing, which made it possible for teachers to add users to groups in courses that the teacher could not otherwise access.

Severity/Risk: Minor
Versions affected: 5.2 to 5.2.1 and 5.1 to 5.1.5
Versions fixed: 5.2.2 and 5.1.6
Reported by: Paul Holden
CVE identifier: Pending (details will be updated once available)
Changes (main): http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-88538
Tracker issue: MDL-88538 Enrolling user to course while selecting group does not validate group belongs to that course
Обсъждане по темата  (0 отговора до сега)

MSA-26-0037: Missing capability checks allow unauthorised triggering of grade penalty recalculation

от Michael Hawkins -

Missing capability checks made it possible for users to trigger grade penalty recalculation without having the capability to do so.

Severity/Risk: Minor
Versions affected: 5.2 to 5.2.1, 5.1 to 5.1.5 and 5.0 to 5.0.8
Versions fixed: 5.2.2, 5.1.6 and 5.0.9
Reported by: Paul Holden
CVE identifier: Pending (details will be updated once available)
Changes (main): http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-88585
Tracker issue: MDL-88585 Missing capability checks allow unauthorised triggering of grade penalty recalculation
Обсъждане по темата  (0 отговора до сега)

MSA-26-0036: Incorrect capability check in AI editor placement "generate image" service

от Michael Hawkins -

An incorrect capability check in the AI "generate image" web service could allow users to access that feature without having the "generate image" capability.

Severity/Risk: Minor
Versions affected: 5.2 to 5.2.1, 5.1 to 5.1.5, 5.0 to 5.0.8, 4.5 to 4.5.12 and earlier unsupported versions
Versions fixed: 5.2.2, 5.1.6, 5.0.9 and 4.5.13
Reported by: Paul Holden
CVE identifier: Pending (details will be updated once available)
Changes (main): http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-88587
Tracker issue: MDL-88587 Incorrect capability check in AI editor placement "generate image" service
Обсъждане по темата  (0 отговора до сега)

MSA-26-0035: Manual enrolment does not correctly observe disabled state of plugin

от Michael Hawkins -

The manual enrolment management page did not prevent direct access when the plugin was disabled and a link was no longer available in the UI. Note: This still required the relevant capability to access the page (had it been enabled).

Severity/Risk: Minor
Versions affected: 5.2 to 5.2.1, 5.1 to 5.1.5, 5.0 to 5.0.8, 4.5 to 4.5.12 and earlier unsupported versions
Versions fixed: 5.2.2, 5.1.6, 5.0.9 and 4.5.13
Reported by: Paul Holden
CVE identifier: Pending (details will be updated once available)
Changes (main): http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-88593
Tracker issue: MDL-88593 Manual enrolment does not correctly observe disabled state of plugin
Обсъждане по темата  (0 отговора до сега)

MSA-26-0034: XSS risk in forum post templates

от Michael Hawkins -

Insufficient escaping resulted in an XSS risk in some templates used to display forum posts.

Severity/Risk: Minor
Versions affected: 5.2 to 5.2.1, 5.1 to 5.1.5, 5.0 to 5.0.8, 4.5 to 4.5.12 and earlier unsupported versions
Versions fixed: 5.2.2, 5.1.6, 5.0.9 and 4.5.13
Reported by: Lars Bonczek
CVE identifier: Pending (details will be updated once available)
Changes (main): http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-88981
Tracker issue: MDL-88981 XSS risk in forum post templates
Обсъждане по темата  (0 отговора до сега)

MSA-26-0033: Arbitrary class instantiation via audience classname in core_reportbuilder

от Michael Hawkins -

Insufficient validation of the audience classname in report builder allowed arbitrary class instantiation.

Severity/Risk: Minor
Versions affected: 5.2 to 5.2.1, 5.1 to 5.1.5, 5.0 to 5.0.8, 4.5 to 4.5.12 and earlier unsupported versions
Versions fixed: 5.2.2, 5.1.6, 5.0.9 and 4.5.13
Reported by: Paul Holden
CVE identifier: Pending (details will be updated once available)
Changes (main): http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-89078
Tracker issue: MDL-89078 Arbitrary class instantiation via audience classname in core_reportbuilder
Обсъждане по темата  (0 отговора до сега)

MSA-26-0032: User profile information disclosure via grade web service

от Michael Hawkins -

An incorrect capability check in a grade web service allowed students to access profile information of other students enrolled in the same course, which they would not otherwise have access to.

Severity/Risk: Serious
Versions affected: 5.2 to 5.2.1, 5.1 to 5.1.5, 5.0 to 5.0.8, 4.5 to 4.5.12 and earlier unsupported versions
Versions fixed: 5.2.2, 5.1.6, 5.0.9 and 4.5.13
Reported by: Itamarperetz2c7cc5
CVE identifier: Pending (details will be updated once available)
Changes (main): http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-89381
Tracker issue: MDL-89381 User profile information disclosure via grade web service
Обсъждане по темата  (0 отговора до сега)