Описание
Moodle SQL Injection vulnerability
Insufficient validation of profile field availability condition resulted in an SQL injection risk (by default only available to teachers and managers).
Ссылки
- https://nvd.nist.gov/vuln/detail/CVE-2023-28329
- https://github.com/moodle/moodle/commit/81e74af17f419f7910f81279efecf5c7af09f38d
- https://bugzilla.redhat.com/show_bug.cgi?id=2179406
- https://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-77046
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3QZN34VSF4HTCW3C3ZP2OZYSLYUKADPF
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3QZN34VSF4HTCW3C3ZP2OZYSLYUKADPF
- https://moodle.org/mod/forum/discuss.php?d=445061
Пакеты
moodle/moodle
>= 4.1.0, < 4.1.2
4.1.2
moodle/moodle
>= 4.0.0, < 4.0.7
4.0.7
moodle/moodle
>= 3.11.0, < 3.11.13
3.11.13
moodle/moodle
< 3.9.20
3.9.20
Связанные уязвимости
Insufficient validation of profile field availability condition resulted in an SQL injection risk (by default only available to teachers and managers).
Insufficient validation of profile field availability condition resulted in an SQL injection risk (by default only available to teachers and managers).
Insufficient validation of profile field availability condition result ...
ALT-PU-2023-2057: package `moodle` update to version 3.11.15-alt1
ALT-PU-2023-2012: package `moodle` update to version 3.11.15-alt1