MSA-18-0018: QuickForm library remote code vulnerability (upstream)

by Michael Hawkins.  

A security vulnerability was reported against QuickForm, a third party library used by Moodle. Although no attack vector was identified within our software, Moodle has updated to patched versions of QuickForm as a precaution.


...
Severity/Risk:Minor
Versions affected:3.5 to 3.5.1, 3.4 to 3.4.4, 3.3 to 3.3.7, 3.1 to 3.1.13 and
Leer más...

MSA-18-0017: Moodle XML import of ddwtos could lead to intentional remote code execution

by Michael Hawkins.  

When importing legacy 'drag and drop into text' (ddwtos) type quiz questions, it was possible to inject and execute PHP code from within the imported questions, either intentionally or by importing questions from an untrusted source.


...
Severity/Risk:Serious
Versions affected:3.5 to 3.5.1, 3.4 to 3.4.4, 3.1 to 3.1.13 and
Leer más...

MSA-18-0016: Quiz question bank import preview could execute JavaScript

by Michael Hawkins.  

When a quiz question bank is imported, it was possible for the question preview that is displayed to execute JavaScript that is written into the question bank.


...
Severity/Risk:Minor
Versions affected:3.5, 3.4 to 3.4.3, 3.3 to 3.3.6, 3.2 to 3.2.9, 3.1 to 3.1.12 and earlier unsupported versions
Versions fixed:3.5.1, 3.4.4,
Leer más...

MSA-18-0015: Web service core_course_get_categories may return invisible categories

by Michael Hawkins.  

It was possible for the core_course_get_categories web service to return hidden categories, which should be omitted when fetching course categories. Note this only affects cases where a user has access to manage categories, but does not also have permission to view hidden categories.


...
Severity/Risk:Minor
Versions affected:3.5
Leer más...