CVSS: 6.5EPSS: 0%CPEs: 5EXPL: 0CVE-2023-35132 – Moodle: minor sql injection risk on mnet sso access control page
https://notcve.org/view.php?id=CVE-2023-35132
22 Jun 2023 — A limited SQL injection risk was identified on the Mnet SSO access control page. This flaw affects Moodle versions 4.2, 4.1 to 4.1.3, 4.0 to 4.0.8, 3.11 to 3.11.14, 3.9 to 3.9.21 and earlier unsupported versions. • https://bugzilla.redhat.com/show_bug.cgi?id=2214371 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 7.8EPSS: 0%CPEs: 5EXPL: 0CVE-2023-35133 – Moodle: ssrf risk due to insufficient check on the curl blocked hosts
https://notcve.org/view.php?id=CVE-2023-35133
22 Jun 2023 — An issue in the logic used to check 0.0.0.0 against the cURL blocked hosts lists resulted in an SSRF risk. This flaw affects Moodle versions 4.2, 4.1 to 4.1.3, 4.0 to 4.0.8, 3.11 to 3.11.14, 3.9 to 3.9.21 and earlier unsupported versions. • https://bugzilla.redhat.com/show_bug.cgi?id=2214373 • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 7.5EPSS: 1%CPEs: 8EXPL: 0CVE-2023-30944 – Moodle: minor sql injection risk in external wiki method for listing pages
https://notcve.org/view.php?id=CVE-2023-30944
02 May 2023 — The vulnerability was found Moodle which exists due to insufficient sanitization of user-supplied data in external Wiki method for listing pages. A remote attacker can send a specially crafted request to the affected application and execute limited SQL commands within the application database. • http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-77187 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 4.3EPSS: 0%CPEs: 6EXPL: 0CVE-2022-40208
https://notcve.org/view.php?id=CVE-2022-40208
24 Mar 2023 — In Moodle, insufficient limitations in some quiz web services made it possible for students to bypass sequential navigation during a quiz attempt. • https://moodle.org/mod/forum/discuss.php?d=438761 • CWE-285: Improper Authorization •
CVSS: 9.0EPSS: 1%CPEs: 8EXPL: 0CVE-2023-28329 – Moodle: authenticated sql injection via availability check
https://notcve.org/view.php?id=CVE-2023-28329
23 Mar 2023 — Insufficient validation of profile field availability condition resulted in an SQL injection risk (by default only available to teachers and managers). • https://bugzilla.redhat.com/show_bug.cgi?id=2179406 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.8EPSS: 0%CPEs: 8EXPL: 0CVE-2023-28330 – Moodle: authenticated arbitrary file read through malformed backup file
https://notcve.org/view.php?id=CVE-2023-28330
23 Mar 2023 — Insufficient sanitizing in backup resulted in an arbitrary file read risk. The capability to access this feature is only available to teachers, managers and admins by default. • https://bugzilla.redhat.com/show_bug.cgi?id=2179412 • CWE-20: Improper Input Validation •
CVSS: 6.4EPSS: 0%CPEs: 8EXPL: 0CVE-2023-28331 – Moodle: xss risk when outputting database activity filter data
https://notcve.org/view.php?id=CVE-2023-28331
23 Mar 2023 — Content output by the database auto-linking filter required additional sanitizing to prevent an XSS risk. • https://bugzilla.redhat.com/show_bug.cgi?id=2179418 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.4EPSS: 0%CPEs: 8EXPL: 0CVE-2023-28332 – Moodle: algebra filter xss when filter is misconfigured
https://notcve.org/view.php?id=CVE-2023-28332
23 Mar 2023 — If the algebra filter was enabled but not functional (eg the necessary binaries were missing from the server), it presented an XSS risk. • https://bugzilla.redhat.com/show_bug.cgi?id=2179419 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 10.0EPSS: 1%CPEs: 9EXPL: 0CVE-2023-28333 – Moodle: pix helper potential mustache code injection risk
https://notcve.org/view.php?id=CVE-2023-28333
23 Mar 2023 — The Mustache pix helper contained a potential Mustache injection risk if combined with user input (note: This did not appear to be implemented/exploitable anywhere in the core Moodle LMS). • https://bugzilla.redhat.com/show_bug.cgi?id=2179422 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 4.3EPSS: 0%CPEs: 9EXPL: 0CVE-2023-28336 – Moodle: teacher can access names of users they do not have permission to access
https://notcve.org/view.php?id=CVE-2023-28336
23 Mar 2023 — Insufficient filtering of grade report history made it possible for teachers to access the names of users they could not otherwise access. • https://bugzilla.redhat.com/show_bug.cgi?id=2179426 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-668: Exposure of Resource to Wrong Sphere •