Security announcements

MSA-26-0043: Possible to bypass the login notification mechanism

by Michael Hawkins -

It was possible to bypass the login notification mechanism, so a user would not be notified if their account received a new login. This could make it easier for unauthorised users to log in without detection. Note: Valid login credentials (such as username and password) were still required.

Severity/Risk: Minor
Versions affected: 5.2 to 5.2.2, 5.1 to 5.1.6, 5.0 to 5.0.9, 4.5 to 4.5.13 and earlier unsupported versions
Versions fixed: 5.2.3, 5.1.7, 5.0.10 and 4.5.14
Reported by: Brendan Heywood
CVE identifier: Pending
Changes (main): http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-87817
Tracker issue: MDL-87817 Possible to bypass the login notification mechanism
Discuss this topic  (0 replies so far)

MSA-26-0042: Blind SQL injection risk in profile availability condition check

by Michael Hawkins -

Insufficient validation of a profile availability condition check resulted in a blind SQL injection risk being available to teachers (and other privileged users such as admins).

Severity/Risk: Serious
Versions affected: 5.2 to 5.2.2, 5.1 to 5.1.6, 5.0 to 5.0.9, 4.5 to 4.5.13 and earlier unsupported versions
Versions fixed: 5.2.3, 5.1.7, 5.0.10 and 4.5.14
Reported by: Vincent Schneider
CVE identifier: Pending
Changes (main): http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-89484
Tracker issue: MDL-89484 Blind SQL injection risk in profile availability condition check
Discuss this topic  (0 replies so far)

MSA-26-0041: CSRF risk in XML grade imports

by Michael Hawkins -

The XML grade import functionality (which allows setting or overwriting of student grades) did not include the necessary token to prevent a CSRF risk.

Severity/Risk: Serious
Versions affected: 5.2 to 5.2.1, 5.1 to 5.1.5, 5.0 to 5.0.8, 4.5 to 4.5.12 and earlier unsupported versions
Versions fixed: 5.2.2, 5.1.6, 5.0.9 and 4.5.13
Reported by: Vincent Schneider
CVE identifier: Pending (details will be updated once available)
Changes (main): http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-84545
Tracker issue: MDL-84545 CSRF risk in XML grade imports
Discuss this topic  (0 replies so far)

MSA-26-0040: User list filters do not respect user profile field visibility

by Michael Hawkins -

User list filters allowed managers to filter by user profile fields that they could not view on users' profiles.

Severity/Risk: Minor
Versions affected: 5.2 to 5.2.1, 5.1 to 5.1.5, 5.0 to 5.0.8, 4.5 to 4.5.12 and earlier unsupported versions
Versions fixed: 5.2.2, 5.1.6, 5.0.9 and 4.5.13
Reported by: Martin Greenaway
CVE identifier: Pending (details will be updated once available)
Changes (main): http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-87518
Tracker issue: MDL-87518 User list filters do not respect user profile field visibility
Discuss this topic  (0 replies so far)

MSA-26-0039: Minor XSS risk via password reset link

by Michael Hawkins -

Insufficient username escaping could allow a minor XSS risk if an unauthenticated user was tricked into opening a password reset link (so did not affect authenticated user sessions).

Severity/Risk: Minor
Versions affected: 5.2 to 5.2.1, 5.1 to 5.1.5, 5.0 to 5.0.8, 4.5 to 4.5.12 and earlier unsupported versions
Versions fixed: 5.2.2, 5.1.6, 5.0.9 and 4.5.13
Reported by: Henk van den Toorn
CVE identifier: Pending (details will be updated once available)
Changes (main): http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-88335
Tracker issue: MDL-88335 Minor XSS risk via password reset link
Discuss this topic  (0 replies so far)

MSA-26-0038: Enrolling user to course while selecting group does not validate group belongs to that course

by Michael Hawkins -

A check to validate a group belonged to a course was missing, which made it possible for teachers to add users to groups in courses that the teacher could not otherwise access.

Severity/Risk: Minor
Versions affected: 5.2 to 5.2.1 and 5.1 to 5.1.5
Versions fixed: 5.2.2 and 5.1.6
Reported by: Paul Holden
CVE identifier: Pending (details will be updated once available)
Changes (main): http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-88538
Tracker issue: MDL-88538 Enrolling user to course while selecting group does not validate group belongs to that course
Discuss this topic  (0 replies so far)

MSA-26-0037: Missing capability checks allow unauthorised triggering of grade penalty recalculation

by Michael Hawkins -

Missing capability checks made it possible for users to trigger grade penalty recalculation without having the capability to do so.

Severity/Risk: Minor
Versions affected: 5.2 to 5.2.1, 5.1 to 5.1.5 and 5.0 to 5.0.8
Versions fixed: 5.2.2, 5.1.6 and 5.0.9
Reported by: Paul Holden
CVE identifier: Pending (details will be updated once available)
Changes (main): http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-88585
Tracker issue: MDL-88585 Missing capability checks allow unauthorised triggering of grade penalty recalculation
Discuss this topic  (0 replies so far)

MSA-26-0036: Incorrect capability check in AI editor placement "generate image" service

by Michael Hawkins -

An incorrect capability check in the AI "generate image" web service could allow users to access that feature without having the "generate image" capability.

Severity/Risk: Minor
Versions affected: 5.2 to 5.2.1, 5.1 to 5.1.5, 5.0 to 5.0.8, 4.5 to 4.5.12 and earlier unsupported versions
Versions fixed: 5.2.2, 5.1.6, 5.0.9 and 4.5.13
Reported by: Paul Holden
CVE identifier: Pending (details will be updated once available)
Changes (main): http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-88587
Tracker issue: MDL-88587 Incorrect capability check in AI editor placement "generate image" service
Discuss this topic  (0 replies so far)

MSA-26-0035: Manual enrolment does not correctly observe disabled state of plugin

by Michael Hawkins -

The manual enrolment management page did not prevent direct access when the plugin was disabled and a link was no longer available in the UI. Note: This still required the relevant capability to access the page (had it been enabled).

Severity/Risk: Minor
Versions affected: 5.2 to 5.2.1, 5.1 to 5.1.5, 5.0 to 5.0.8, 4.5 to 4.5.12 and earlier unsupported versions
Versions fixed: 5.2.2, 5.1.6, 5.0.9 and 4.5.13
Reported by: Paul Holden
CVE identifier: Pending (details will be updated once available)
Changes (main): http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-88593
Tracker issue: MDL-88593 Manual enrolment does not correctly observe disabled state of plugin
Discuss this topic  (0 replies so far)

MSA-26-0034: XSS risk in forum post templates

by Michael Hawkins -

Insufficient escaping resulted in an XSS risk in some templates used to display forum posts.

Severity/Risk: Minor
Versions affected: 5.2 to 5.2.1, 5.1 to 5.1.5, 5.0 to 5.0.8, 4.5 to 4.5.12 and earlier unsupported versions
Versions fixed: 5.2.2, 5.1.6, 5.0.9 and 4.5.13
Reported by: Lars Bonczek
CVE identifier: Pending (details will be updated once available)
Changes (main): http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-88981
Tracker issue: MDL-88981 XSS risk in forum post templates
Discuss this topic  (0 replies so far)