Security announcements

MSA-15-0036: XSS in grouping description

by Marina Glancy -
Description: Capability to manage groups does not have XSS risk, however it was possible to add XSS to the grouping description
Issue summary: XSS in grouping description
Severity/Risk: Minor
Versions affected: 2.9 to 2.9.1, 2.8 to 2.8.7, 2.7 to 2.7.9 and earlier unsupported versions
Versions fixed: 2.9.2, 2.8.8 and 2.7.10
Reported by: Marina Glancy
Issue no.: MDL-50709
CVE identifier: CVE-2015-5269
Changes (master): http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-50709
Discuss this topic  (0 replies so far)

MSA-15-0035: Rating component does not check separate groups

by Marina Glancy -
Description: When viewing ratings the group access was not properly checked allowing users from other groups to view ratings
Issue summary: Rating component does not check separate groups
Severity/Risk: Minor
Versions affected: 2.9 to 2.9.1, 2.8 to 2.8.7, 2.7 to 2.7.9 and earlier unsupported versions
Versions fixed: 2.9.2, 2.8.8 and 2.7.10
Reported by: Juan Leyva
Issue no.: MDL-50173
CVE identifier: CVE-2015-5268
Changes (master): http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-50173
Discuss this topic  (0 replies so far)

MSA-15-0034: Vulnerability in password recovery mechanism

by Marina Glancy -
Description: Password recovery token can be guessed because of php randomisation limitations
Issue summary: Vulnerability in password recovery mechanism
Severity/Risk: Serious
Versions affected: 2.9 to 2.9.1, 2.8 to 2.8.7, 2.7 to 2.7.9 and earlier unsupported versions
Versions fixed: 2.9.2, 2.8.8 and 2.7.10
Reported by: Vincent Herbulot (@us3r777)
Issue no.: MDL-50860
CVE identifier: CVE-2015-5267
Changes (master): http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-50860
Discuss this topic  (0 replies so far)

MSA-15-0033: Meta course synchronisation enrols suspended students as managers for a short period of time

by Marina Glancy -
Description: On large installations, when sync script takes a long time, suspended students may get assigned a manager role in meta course for several minutes
Issue summary: Meta course sync enroling suspended students as managers and causing large database growth
Severity/Risk: Minor
Versions affected: 2.9 to 2.9.1, 2.8 to 2.8.7, 2.7 to 2.7.9 and earlier unsupported versions
Versions fixed: 2.9.2, 2.8.8 and 2.7.10
Reported by: Brian Winstead
Issue no.: MDL-50744
CVE identifier: CVE-2015-5266
Changes (master): http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-50744
Discuss this topic  (0 replies so far)

MSA-15-0032: Users can delete files uploaded by other users in wiki

by Marina Glancy -
Description: Users can delete files uploaded by other users in wiki without capability to manage files
Issue summary: Disable free access to the file manager in the wiki via the text editor.
Severity/Risk: Minor
Versions affected: 2.9 to 2.9.1, 2.8 to 2.8.7, 2.7 to 2.7.9 and earlier unsupported versions
Versions fixed: 2.9.2, 2.8.8 and 2.7.10
Reported by: John Provasnik
Issue no.: MDL-48371
CVE identifier: CVE-2015-5265
Changes (master): http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-48371
Discuss this topic  (0 replies so far)

MSA-15-0031: Teacher in forum can still post to "all participants" and groups they are not members of

by Marina Glancy -
Description: Group access is not properly checked when posting to "all participants" in forum
Issue summary: Teacher without accessallgroups can still post to "all participants" and groups they're not members of
Severity/Risk: Minor
Versions affected: 2.7 to 2.7.9 and earlier unsupported versions
Versions fixed: 2.7.10
Reported by: David Scotson
Issue no.: MDL-50576
CVE identifier: CVE-2015-5272
Changes (master): http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-50576
Discuss this topic  (0 replies so far)

MSA-15-0030: Students can re-attempt answering questions in the lesson

by Marina Glancy -
Description: Completed and graded lesson activity was not protected against making new attempt to answer some questions
Issue summary: Students can re-attempt answering questions in the lesson
Severity/Risk: Minor
Versions affected: 2.9 to 2.9.1, 2.8 to 2.8.7, 2.7 to 2.7.9 and earlier unsupported versions
Versions fixed: 2.9.2, 2.8.8 and 2.7.10
Reported by: Eric Eakin
Issue no.: MDL-50516
CVE identifier: CVE-2015-5264
Changes (master): http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-50516
Discuss this topic  (0 replies so far)

MSA-15-0029: Javascript injection in SCORM module

by Marina Glancy -
Description: Penetration test discovered possible Javascript injection in SCORM module
Issue summary: Inadequate JavaScript Handling in SCORM
Severity/Risk: Minor
Versions affected: 2.9, 2.8 to 2.8.6, 2.7 to 2.7.8 and earlier unsupported versions
Versions fixed: 2.9.1, 2.8.7 and 2.7.9
Reported by: Martin Greenaway
Issue no.: MDL-50614
CVE identifier: CVE-2015-3275
Changes (master): http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-50614
Discuss this topic  (0 replies so far)

MSA-15-0028: Possible XSS through custom text profile fields in Web Services

by Marina Glancy -
Description: Several web services returning user information did not clean text in text custom profile fields
Issue summary: Custom profile fields (textarea) are not passed through external_format_text when returned by several web services
Severity/Risk: Minor
Versions affected: 2.9, 2.8 to 2.8.6, 2.7 to 2.7.8 and earlier unsupported versions
Versions fixed: 2.9.1, 2.8.7 and 2.7.9
Reported by: Marina Glancy
Issue no.: MDL-50130
CVE identifier: CVE-2015-3274
Changes (master): http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-50130
Discuss this topic  (0 replies so far)

MSA-15-0027: Capability 'mod/forum:canposttomygroups' is not respected when using 'Post a copy to all groups' in forum

by Marina Glancy -
Description: Capability 'mod/forum:canposttomygroups' was not respected when using 'Post a copy to all groups' in forum. Capability to post to each individual group was always required.
Issue summary: canposttomygroups capability is not checked in mod/forum/post.php
Severity/Risk: Minor
Versions affected: 2.9
Versions fixed: 2.9.1
Reported by: Juan Leyva
Issue no.: MDL-50220
CVE identifier: CVE-2015-3273
Changes (master): http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-50220
Discuss this topic  (0 replies so far)