Moodle Chile Servicios Moodle en Chile

  • Inicio
  • Moodle
    • Productos
    • Servicios
    • Sobre Moodle
    • Sobre Moodle Chile
  • Blog
    • Noticias
      • Seguridad Moodle
      • Planeta Moodle
      • Moodle.org Directo
      • Moodle Buzz
      • Moodle Foro
      • Google News
      • Todas las Noticias
    • Artículos
  • Contactar
  • + Más
    • Boletines
    • Buscar
    • Cotizar

MSA-20-0016: Teacher is able to unenrol users without permission using course restore

Detalles
Publicado el 16 Noviembre 2020
Categoría: Seguridad
  • Imprimir
  • Correo electrónico
by Michael Hawkins.  

Users' enrolment capabilities were not being sufficiently checked when they restored into an existing course, which could lead to them unenrolling users without having permission to do so.


...
Severity/Risk:Minor
Versions affected:3.9 to 3.9.2, 3.8 to 3.8.5, 3.7 to 3.7.8, 3.5 to 3.5.14 and earlier unsupported versions
Versions
Leer más...

MSA-20-0017: Privilege escalation within a course when restoring role overrides

Detalles
Publicado el 16 Noviembre 2020
Categoría: Seguridad
  • Imprimir
  • Correo electrónico
by Michael Hawkins.  

Insufficient capability checks could lead to users with the ability to course restore adding additional capabilities to roles within that course.


...
Severity/Risk:Minor
Versions affected:3.9 to 3.9.2, 3.8 to 3.8.5, 3.7 to 3.7.8, 3.5 to 3.5.14 and earlier unsupported versions
Versions fixed:3.10, 3.9.3, 3.8.6, 3.7.9 and 3.5.15
Rep
Leer más...

MSA-20-0018: Some database module web services did not respect group settings

Detalles
Publicado el 16 Noviembre 2020
Categoría: Seguridad
  • Imprimir
  • Correo electrónico
by Michael Hawkins.  

Some database module web services allowed students to add entries within groups they did not belong to.


...
Severity/Risk:Minor
Versions affected:3.9 to 3.9.2, 3.8 to 3.8.5, 3.7 to 3.7.8, 3.5 to 3.5.14 and earlier unsupported versions
Versions fixed:3.10, 3.9.3, 3.8.6, 3.7.9 and 3.5.15
Reported by:Dani Palou
CVE identifier:CVE-2020
Leer más...

MSA-20-0019: tool_uploadcourse creates new enrol instances unexpectedly in some circumstances

Detalles
Publicado el 16 Noviembre 2020
Categoría: Seguridad
  • Imprimir
  • Correo electrónico
by Michael Hawkins.  

If the upload course tool was used to delete an enrolment method which did not exist or was not already enabled, the tool would erroneously enable that enrolment method. This could lead to unintended users gaining access to the course.


...
Severity/Risk:Minor
Versions affected:3.9 to 3.9.2, 3.8 to 3.8.5, 3.7 to 3.7.8 and 3.5 to
Leer más...

MSA-20-0020: Stored XSS possible when renaming content bank items

Detalles
Publicado el 16 Noviembre 2020
Categoría: Seguridad
  • Imprimir
  • Correo electrónico
by Michael Hawkins.  

It was possible to include JavaScript when re-naming content bank items.


...
Severity/Risk:Minor
Versions affected:3.9 to 3.9.2
Versions fixed:3.10, 3.9.3
Reported by:DegrangeM
CVE identifier:CVE-2020-25702
Changes (master):http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-69046
Tracker issue:MDL-6
Leer más...

MSA-20-0021: The participants table download feature did not respect the site's show user identity configuration

Detalles
Publicado el 16 Noviembre 2020
Categoría: Seguridad
  • Imprimir
  • Correo electrónico
by Michael Hawkins.  

The participants table download always included user emails, but should have only done so when users' emails are not hidden.


...
Severity/Risk:Minor
Versions affected:3.9 to 3.9.2, 3.8 to 3.8.5 and 3.7 to 3.7.8
Versions fixed:3.10, 3.9.3, 3.8.6 and 3.7.9
Reported by:A. Schenkel
CVE identifier:CVE-2020-25703
Changes (master):http://g
Leer más...

MSA-20-0011: Stored XSS via moodlenetprofile parameter in user profile

Detalles
Publicado el 21 Septiembre 2020
Categoría: Seguridad
  • Imprimir
  • Correo electrónico
von Michael Hawkins.  

The moodlenetprofile user profile field required extra sanitizing to prevent a stored XSS risk.


...
Severity/Risk:Serious
Versions affected:3.9 to 3.9.1
Versions fixed:3.9.2
Reported by:Kien Hoang
CVE identifier:CVE-2020-25627
Changes (master):http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-692
Leer más...

MSA-20-0012: Reflected XSS in tag manager

Detalles
Publicado el 21 Septiembre 2020
Categoría: Seguridad
  • Imprimir
  • Correo electrónico
von Michael Hawkins.  

The filter in the admin task log required extra sanitizing to prevent a reflected XSS risk.


...
Severity/Risk:Serious
Versions affected:3.9 to 3.9.1, 3.8 to 3.8.4, 3.7 to 3.7.7, 3.5 to 3.5.13 and earlier unsupported versions
Versions fixed:3.9.2, 3.8.5, 3.7.8 and 3.5.14
Reported by:Luuk Verhoeven
CVE identifier:CVE-2020-25628
Chang
Leer más...

MSA-20-0013: Log in as capability in a course context may lead to some privilege escalation

Detalles
Publicado el 21 Septiembre 2020
Categoría: Seguridad
  • Imprimir
  • Correo electrónico
von Michael Hawkins.  

Users with "Log in as" capability in a course context (typically, course managers) may gain access to some site administration capabilities by "logging in as" a System manager.


...
Severity/Risk:Minor
Versions affected:3.9 to 3.9.1, 3.8 to 3.8.4, 3.7 to 3.7.7, 3.5 to 3.5.13 and earlier unsupported versions
Versions fixed:3.9.2,
Leer más...

MSA-20-0014: Denial of service risk in file picker unzip functionality

Detalles
Publicado el 21 Septiembre 2020
Categoría: Seguridad
  • Imprimir
  • Correo electrónico
von Michael Hawkins.  

The decompressed size of zip files was not checked against available user quota before unzipping them, which could lead to a denial of service risk.


...
Severity/Risk:Serious
Versions affected:3.9 to 3.9.1, 3.8 to 3.8.4, 3.7 to 3.7.7, 3.5 to 3.5.13 and earlier unsupported versions
Versions fixed:3.9.2, 3.8.5, 3.7.8 and 3.5.14
Rep
Leer más...

MSA-20-0015: Chapter name in book not always escaped with forceclean enabled

Detalles
Publicado el 21 Septiembre 2020
Categoría: Seguridad
  • Imprimir
  • Correo electrónico
von Michael Hawkins.  

It was possible to include JavaScript in a book's chapter title, which was not escaped on the "Add new chapter" page.

Note: By default this functionality is only available to trusted users (such as teachers), but has been included as a security issue as a precaution, since it was not sanitized on sites with forceclean...

Leer más...

MSA-20-0007: Vulnerable JavaScript libraries: jQuery 1.9.1 (upstream)

Detalles
Publicado el 20 Julio 2020
Categoría: Seguridad
  • Imprimir
  • Correo electrónico
by Michael Hawkins.  

The JQuery version used by the H5P library contained a prototype pollution risk, which has now been updated to a patched version.


...
Severity/Risk:Minor
Versions affected:3.8 to 3.8.3
Versions fixed:3.8.4 and 3.9
Reported by:weblendweb
CVE identifier:CVE-2019-11358
Changes (master):http://git.moodle.org/gw?p=moodle.git&a=search
Leer más...

MSA-20-0008: Reflected XSS in admin task logs filter

Detalles
Publicado el 20 Julio 2020
Categoría: Seguridad
  • Imprimir
  • Correo electrónico
by Michael Hawkins.  

The filter in the admin task log required extra sanitizing to prevent a reflected XSS risk.


...
Severity/Risk:Serious
Versions affected:3.9, 3.8 to 3.8.3 and 3.7 to 3.7.6
Versions fixed:3.9.1, 3.8.4 and 3.7.7
Reported by:Spyridon Chatzimichail
CVE identifier:CVE-2020-14320
Changes (master):http://git.moodle.org/gw?p=moodle.git&a
Leer más...

MSA-20-0009: Course enrolments allowed privilege escalation from teacher role into manager role

Detalles
Publicado el 20 Julio 2020
Categoría: Seguridad
  • Imprimir
  • Correo electrónico
by Michael Hawkins.  

Teachers of a course were able to assign themselves the manager role within that course.


...
Severity/Risk:Serious
Versions affected:3.9, 3.8 to 3.8.3, 3.7 to 3.7.6, 3.5 to 3.5.12 and earlier unsupported versions
Versions fixed:3.9.1, 3.8.4, 3.7.7 and 3.5.13
Reported by:Kien Hoang
CVE identifier:CVE-2020-14321
Changes (master):http:
Leer más...

MSA-20-0010: yui_combo should mitigate denial of service risk

Detalles
Publicado el 20 Julio 2020
Categoría: Seguridad
  • Imprimir
  • Correo electrónico
by Michael Hawkins.  

yui_combo needed to limit the amount of files it can load to help mitigate the risk of denial of service.


...
Severity/Risk:Serious
Versions affected:3.9, 3.8 to 3.8.3, 3.7 to 3.7.6, 3.5 to 3.5.12 and earlier unsupported versions
Versions fixed:3.9.1, 3.8.4, 3.7.7 and 3.5.13
Reported by:Yuri Zwaig
CVE identifier:CVE-2020-14322
Chang
Leer más...

MSA-20-0005: MathJax URL upgraded to later version to remove XSS risk (upstream)

Detalles
Publicado el 18 Mayo 2020
Categoría: Seguridad
  • Imprimir
  • Correo electrónico
by Michael Hawkins.  

MathJax versions 2.7.2 and earlier contain a stored XSS risk. The MathJax URL has been updated to reference a newer version, which has the vulnerability patched.


...
Severity/Risk:Serious
Versions affected:3.8 to 3.8.2, 3.7 to 3.7.5, 3.6 to 3.6.9, 3.5 to 3.5.11 and earlier unsupported versions
Versions fixed:3.8.3, 3.7.6, 3.6.10
Leer más...

MSA-20-0006: Remote code execution possible via SCORM packages

Detalles
Publicado el 18 Mayo 2020
Categoría: Seguridad
  • Imprimir
  • Correo electrónico
by Michael Hawkins.  

It was possible to create a SCORM package in such a way that when added to a course, it could be interacted with via web services in order to achieve remote code execution.


...
Severity/Risk:Serious
Versions affected:3.8 to 3.8.2, 3.7 to 3.7.5, 3.6 to 3.6.9, 3.5 to 3.5.11 and earlier unsupported versions
Versions fixed:3.8.3,
Leer más...

MSA-20-0002: Grade history report does not respect Separate groups mode in the course settings

Detalles
Publicado el 16 Marzo 2020
Categoría: Seguridad
  • Imprimir
  • Correo electrónico
by Michael Hawkins.  

Users viewing the grade history report without the 'access all groups' capability were not restricted to viewing grades of users within their own groups.


...
Severity/Risk:Minor
Versions affected:3.8 to 3.8.1, 3.7 to 3.7.4, 3.6 to 3.6.8, 3.5 to 3.5.10 and earlier unsupported versions
Versions fixed:3.8.2, 3.7.5, 3.6.9 and 3.5.11
R
Leer más...

MSA-20-0003: IP addresses can be spoofed using X-Forwarded-For

Detalles
Publicado el 16 Marzo 2020
Categoría: Seguridad
  • Imprimir
  • Correo electrónico
by Michael Hawkins.  

X-Forwarded-For headers could be used to spoof a user's IP, in order to bypass remote address checks.

PATCH NOTE: For user IPs to be checked (and logged) accurately after this patch is applied, sites using multiple levels of reverse proxies/balancers that append to the X-Forwarded-For header will need to configure the new "...

Leer más...

MSA-20-0004: Admin PHP unit webrunner tool requires additional input escaping

Detalles
Publicado el 16 Marzo 2020
Categoría: Seguridad
  • Imprimir
  • Correo electrónico
by Michael Hawkins.  

Insufficient input escaping was applied to the PHP unit webrunner admin tool.

NOTE: It is important to note that this update is only flagged as a precautionary measure, as it may provide limited CLI access to Moodle site admins. This may be considered a security risk in circumstances where admins do not ordinarily have...

Leer más...

Más artículos...

  1. MSA-20-0001: Stored XSS in message conversation overview
  2. MSA-19-0024: Assigned Role in Cohort did not un-assign on removal
  3. MSA-19-0025: Add additional verification for some OAuth 2 logins to prevent account compromise
  4. MSA-19-0026: Blind XSS reflected in some locations where user email is displayed
  5. MSA-19-0027: Open redirect in Lesson edit page
  6. MSA-19-0028: Email media URL tokens were not checking for user status
  7. MSA-19-0029: Reflected XSS possible from some fatal error messages
  8. Re: MSA-19-0019: Course creation did not check the creator's role assignment capability before automatically assigning them as a teacher in the course
  9. MSA-19-0018: JavaScript injection possible in some Mustache templates via recursive rendering from contexts
  10. MSA-19-0019: Course creation did not check the creator's role assignment capability before automatically assigning them as a teacher in the course
  11. MSA-19-0020: Python Machine Learning dependency versions bumped
  12. MSA-19-0021: Activity :addinstance capabilities were not respected when creating a course in single activity format
  13. MSA-19-0022: Open redirect in the mobile launch endpoint could be used to expose mobile access tokens
  14. MSA-19-0023: Forum subscribe link contained an open redirect if forced subscription mode was enabled
  15. MSA-19-0013: Missing sesskey (CSRF) token in loading/unloading XML files
  16. MSA-19-0014: Ability to delete glossary entries that belong to another glossary
  17. MSA-19-0015: Quiz group overrides did not observe groups membership or accessallgroups
  18. MSA-19-0016: Assignment group overrides did not observe separate groups mode
  19. MSA-19-0017: Upgrade TCPDF library for PHP 7.3 and bug fixes (upstream)
  20. MSA-19-0010: All messaging conversations could be viewed

Página 1 de 54

  • Inicio
  • Anterior
  • 1
  • 2
  • 3
  • 4
  • 5
  • 6
  • 7
  • 8
  • 9
  • 10
  • Siguiente
  • Final
  • Home
  • Blog
  • Noticias
  • Todas las Noticias

Moodle-Chile.cl is not affiliated with or endorsed by the Moodle Project. The Moodle name and logo is used under a limited license granted by Moodle.org the trademark holder in the United States and other countries.

Powered by TILATAM S.A.