Moodle — система управления образовательными электронными курсами
Релизный цикл, информация об уязвимостях
График релизов
Количество 2 764
CVE-2024-43432
A flaw was found in moodle. The cURL wrapper in Moodle strips HTTPAUTH and USERPWD headers during emulated redirects, but retains other original request headers, so HTTP authorization header information could be unintentionally sent in requests to redirect URLs.
CVE-2024-43437
A flaw was found in moodle. Insufficient sanitizing of data when performing a restore could result in a cross-site scripting (XSS) risk from malicious backup files.
CVE-2024-43429
A flaw was found in moodle. Some hidden user profile fields are visible in gradebook reports, which could result in users without the "view hidden user fields" capability having access to the information.
CVE-2024-43439
A flaw was found in moodle. H5P error messages require additional sanitizing to prevent a reflected cross-site scripting (XSS) risk.
CVE-2024-43433
A flaw was found in moodle. Matrix room membership and power levels are incorrectly applied and revoked for suspended Moodle users.
GHSA-4hjf-6pxr-549h
Moodle Cross-site Scripting vulnerability
GHSA-4gq2-x5w4-7hp8
Moodle has insufficient capability checks
GHSA-7wmp-2xmx-g6h8
Moodle authorization headers preserved between "emulated redirects"
GHSA-hjgc-jxjc-8v9j
Moodle reflected XSS via H5P error message
GHSA-vpq5-56jj-vf2m
Moodle admin presets export tool includes some secrets that should not be exported
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано 1 | |
|---|---|---|---|---|
 | CVE-2024-43432 A flaw was found in moodle. The cURL wrapper in Moodle strips HTTPAUTH and USERPWD headers during emulated redirects, but retains other original request headers, so HTTP authorization header information could be unintentionally sent in requests to redirect URLs. | CVSS3: 5.3 | 0% Низкий | почти 2 года назад |
| CVE-2024-43437 A flaw was found in moodle. Insufficient sanitizing of data when performing a restore could result in a cross-site scripting (XSS) risk from malicious backup files. | CVSS3: 6.1 | 0% Низкий | почти 2 года назад |
| CVE-2024-43429 A flaw was found in moodle. Some hidden user profile fields are visible in gradebook reports, which could result in users without the "view hidden user fields" capability having access to the information. | CVSS3: 5.3 | 0% Низкий | почти 2 года назад |
| CVE-2024-43439 A flaw was found in moodle. H5P error messages require additional sanitizing to prevent a reflected cross-site scripting (XSS) risk. | CVSS3: 6.1 | 0% Низкий | почти 2 года назад |
| CVE-2024-43433 A flaw was found in moodle. Matrix room membership and power levels are incorrectly applied and revoked for suspended Moodle users. | CVSS3: 5.3 | 0% Низкий | почти 2 года назад |
| GHSA-4hjf-6pxr-549h Moodle Cross-site Scripting vulnerability | CVSS3: 5.4 | 0% Низкий | почти 2 года назад |
| GHSA-4gq2-x5w4-7hp8 Moodle has insufficient capability checks | CVSS3: 5.3 | 0% Низкий | почти 2 года назад |
| GHSA-7wmp-2xmx-g6h8 Moodle authorization headers preserved between "emulated redirects" | CVSS3: 5.3 | 0% Низкий | почти 2 года назад |
| GHSA-hjgc-jxjc-8v9j Moodle reflected XSS via H5P error message | CVSS3: 5.4 | 0% Низкий | почти 2 года назад |
| GHSA-vpq5-56jj-vf2m Moodle admin presets export tool includes some secrets that should not be exported | CVSS3: 3.7 | 0% Низкий | почти 2 года назад |
Уязвимостей на страницу