Authenticated users were able to enumerate other users' names via the learning plans page.
| Severity/Risk: | Minor |
| Versions affected: | 4.1 to 4.1.1 and 4.0 to 4.0.6 |
| Versions fixed: | 4.1.2 and 4.0.7 |
| Reported by: | Paul Holden |
| CVE identifier: | CVE-2023-28334 |
| Changes (master): | http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-77129 |
| Tracker issue: | MDL-77129 Users' name enumeration possible via IDOR on learning plans page |
The Mustache pix helper contained a potential Mustache injection risk if combined with user input (note: This did not appear to be implemented/exploitable anywhere in the core Moodle LMS).
| Severity/Risk: | Minor |
| Versions affected: | 4.1 to 4.1.1, 4.0 to 4.0.6, 3.11 to 3.11.12, 3.9 to 3.9.19 and earlier unsupported versions |
| Versions fixed: | 4.1.2, 4.0.7, 3.11.13 and 3.9.20 |
| Reported by: | Lars Bonczek |
| CVE identifier: | CVE-2023-28333 |
| Changes (master): | http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-75659 |
| Tracker issue: | MDL-75659 Pix helper potential Mustache code injection risk |
If the algebra filter was enabled but not functional (eg the necessary binaries were missing from the server), it presented an XSS risk.
| Severity/Risk: | Minor |
| Versions affected: | 4.1 to 4.1.1, 4.0 to 4.0.6, 3.11 to 3.11.12, 3.9 to 3.9.19 and earlier unsupported versions |
| Versions fixed: | 4.1.2, 4.0.7, 3.11.13 and 3.9.20 |
| Reported by: | Petr Skoda |
| Workaround: | Ensure that if the algebra filter is enabled, it is correctly configured and functional (otherwise, ensure it is disabled). |
| CVE identifier: | CVE-2023-28332 |
| Changes (master): | http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-77524 |
| Tracker issue: | MDL-77524 Algebra filter XSS when filter is misconfigured |
Content output by the database auto-linking filter required additional sanitizing to prevent an XSS risk.
| Severity/Risk: | Serious |
| Versions affected: | 4.1 to 4.1.1, 4.0 to 4.0.6, 3.11 to 3.11.12, 3.9 to 3.9.19 and earlier unsupported versions |
| Versions fixed: | 4.1.2, 4.0.7, 3.11.13 and 3.9.20 |
| Reported by: | Petr Skoda |
| Workaround: | Disable the database auto-linking filter until the patch has been applied. |
| CVE identifier: | CVE-2023-28331 |
| Changes (master): | http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-76645 |
| Tracker issue: | MDL-76645 XSS risk when outputting database activity filter data |
Insufficient sanitizing in backup resulted in an arbitrary file read risk. The capability to access this feature is only available to teachers, managers and admins by default.
| Severity/Risk: | Serious |
| Versions affected: | 4.1 to 4.1.1, 4.0 to 4.0.6, 3.11 to 3.11.12, 3.9 to 3.9.19 and earlier unsupported versions |
| Versions fixed: | 4.1.2, 4.0.7, 3.11.13 and 3.9.20 |
| Reported by: | Vincent Schneider (cli-ish) |
| Workaround: | Remove restore activity/course capabilities until the patch is applied. |
| CVE identifier: | CVE-2023-28330 |
| Changes (master): | http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-77204 |
| Tracker issue: | MDL-77204 Authenticated arbitrary file read through malformed backup file |
Insufficient validation of profile field availability condition resulted in an SQL injection risk (by default only available to teachers and managers).
| Severity/Risk: | Serious |
| Versions affected: | 4.1 to 4.1.1, 4.0 to 4.0.6, 3.11 to 3.11.12, 3.9 to 3.9.19 and earlier unsupported versions |
| Versions fixed: | 4.1.2, 4.0.7, 3.11.13 and 3.9.20 |
| Reported by: | Vincent Schneider (cli-ish) |
| CVE identifier: | CVE-2023-28329 |
| Changes (master): | http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-77046 |
| Tracker issue: | MDL-77046 Authenticated SQL injection via availability check |
Insufficient limitations on the "start page" preference made it possible to set that preference for another user. (Note: This was still limited to the pre-defined start page options)
| Severity/Risk: | Minor |
| Versions affected: | 4.1, 4.0 to 4.0.5, 3.11 to 3.11.11, 3.9 to 3.9.18 and earlier unsupported versions |
| Versions fixed: | 4.1.1, 4.0.6, 3.11.12 and 3.9.19 |
| Reported by: | Paul Holden |
| CVE identifier: | CVE-2023-23923 |
| Changes (master): | http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-76862 |
| Tracker issue: | MDL-76862 Possible to set the preferred "start page" of other users |
Blog search required additional sanitizing to prevent a reflected XSS risk.
| Severity/Risk: | Serious |
| Versions affected: | 4.1 and 4.0 to 4.0.5 |
| Versions fixed: | 4.1.1, 4.0.6 |
| Reported by: | Unknown (name not provided) |
| CVE identifier: | CVE-2023-23922 |
| Changes (master): | http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-76861 |
| Tracker issue: | MDL-76861 Reflected XSS risk in blog search |
Some returnurl parameters required additional sanitizing to prevent a reflected XSS risk.
| Severity/Risk: | Serious |
| Versions affected: | 4.1, 4.0 to 4.0.5, 3.11 to 3.11.11, 3.9 to 3.9.18 and earlier unsupported versions |
| Versions fixed: | 4.1.1, 4.0.6, 3.11.12 and 3.9.19 |
| Reported by: | DegrangeM |
| CVE identifier: | CVE-2023-23921 |
| Changes (master): | http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-76810 |
| Tracker issue: | MDL-76810 Reflected XSS risk in some returnurl parameters |
Moodle's LTI provider library did not utilise Moodle's inbuilt cURL helper, which resulted in a blind SSRF risk.
| Severity/Risk: | Serious |
| Versions affected: | 4.0 to 4.0.4, 3.11 to 3.11.10, 3.9 to 3.9.17 and earlier unsupported versions |
| Versions fixed: | 4.0.5, 3.11.11 and 3.9.18 |
| Reported by: | Rekter0 and Holme |
| CVE identifier: | CVE-2022-45152 |
| Changes (master): | http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-71920 |
| Tracker issue: | MDL-71920 Blind SSRF risk in LTI provider library |