MSA-17-0019: user_can_view_profile() incorrectly assumes $course as shared course

by Marina Glancy.  

This fix may affect plugins using this API function, there is no exploit in standard Moodle


...
Severity/Risk:Minor
Versions affected:3.3 to 3.3.1, 3.2 to 3.2.4, 3.1 to 3.1.7 and earlier unsupported versions
Versions fixed:3.3.2, 3.2.5 and 3.1.8
Reported by:Ankit Agarwal
Changes (master):http://git.moodle.org/gw?p=moodle.git&a=se
Register to read more...

MSA-17-0018: Course reports are not respecting group settings in courses

by Marina Glancy.  

Number of course reports allowed teachers to view details about users in the groups they can't access


...
Severity/Risk:Minor
Versions affected:3.3 to 3.3.1, 3.2 to 3.2.4, 3.1 to 3.1.7 and earlier unsupported versions
Versions fixed:3.3.2, 3.2.5 and 3.1.8
Reported by:Juan Leyva
CVE identifier:CVE-2017-12157
Changes (master):http://git
Register to read more...

MSA-17-0017: XSS in contact form on non-respondents page in non-anonymous feedback

by Marina Glancy.  

Form on the feedback "non-respondents" page does not escape the value of subject thus creating self-XSS. This can be used to attack another user by tricking them into opening malicious URL whilst in an open Moodle session


...
Severity/Risk:Minor
Versions affected:3.3 to 3.3.1, 3.2 to 3.2.4, 3.1 to 3.1.7 and earlier unsupported
Register to read more...

MSA-17-0016: Authentication bypass vulnerability with old CAS servers

by Marina Glancy.  

Old CAS servers (3.3.5.1 or 3.4.2.1, both released Jul 21, 2010) do not escape the failure message which could be exploited with the phpCAS client library that is shipped as part of Moodle. Only fix for this issue was picked to phpCAS library in Moodle, the library will be upgraded to the latest version in the next major...

Register to read more...