CVSS: 4.3EPSS: 0%CPEs: 3EXPL: 0CVE-2022-0985
https://notcve.org/view.php?id=CVE-2022-0985
29 Apr 2022 — Insufficient capability checks could allow users with the moodle/site:uploadusers capability to delete users, without having the necessary moodle/user:delete capability. Las comprobaciones de capacidad insuficientes podrían permitir a usuarios con la capacidad moodle/site:uploadusers eliminar usuarios, sin tener la capacidad moodle/user:delete necesaria • https://bugzilla.redhat.com/show_bug.cgi?id=2064117 • CWE-287: Improper Authentication CWE-863: Incorrect Authorization •
CVSS: 5.3EPSS: 0%CPEs: 4EXPL: 0CVE-2021-32473
https://notcve.org/view.php?id=CVE-2021-32473
11 Mar 2022 — It was possible for a student to view their quiz grade before it had been released, using a quiz web service. Moodle 3.10 to 3.10.3, 3.9 to 3.9.6, 3.8 to 3.8.8, 3.5 to 3.5.17 and earlier unsupported versions are affected Era posible que un estudiante visualice la nota de su cuestionario antes de que se hubiera publicado, usando un servicio web de cuestionarios. Moodle versiones 3.10 a 3.10.3, 3.9 a 3.9.6, 3.8 a 3.8.8, 3.5 a 3.5.17 y versiones anteriores no soportadas están afectadas • https://moodle.org/mod/forum/discuss.php?d=422307 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.2EPSS: 0%CPEs: 4EXPL: 0CVE-2021-32474
https://notcve.org/view.php?id=CVE-2021-32474
11 Mar 2022 — An SQL injection risk existed on sites with MNet enabled and configured, via an XML-RPC call from the connected peer host. Note that this required site administrator access or access to the keypair. Moodle 3.10 to 3.10.3, 3.9 to 3.9.6, 3.8 to 3.8.8, 3.5 to 3.5.17 and earlier unsupported versions are affected. Se presentaba un riesgo de inyección SQL en sitios con MNet habilitado y configurado, por medio de una llamada XML-RPC desde el host par conectado. Tenga en cuenta que esto requería el acceso del admin... • https://moodle.org/mod/forum/discuss.php?d=422308 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 5.4EPSS: 0%CPEs: 4EXPL: 0CVE-2021-32475
https://notcve.org/view.php?id=CVE-2021-32475
11 Mar 2022 — ID numbers displayed in the quiz grading report required additional sanitizing to prevent a stored XSS risk. Moodle 3.10 to 3.10.3, 3.9 to 3.9.6, 3.8 to 3.8.8, 3.5 to 3.5.17 and earlier unsupported versions are affected. Los números de identificación mostrados en el informe de calificación de los cuestionarios requerían un saneo adicional para evitar un riesgo de tipo XSS almacenado. Moodle versiones 3.10 a 3.10.3, 3.9 a 3.9.6, 3.8 a 3.8.8, 3.5 a 3.5.17 y versiones anteriores no soportadas están afectadas • https://moodle.org/mod/forum/discuss.php?d=422309 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 0CVE-2021-32476
https://notcve.org/view.php?id=CVE-2021-32476
11 Mar 2022 — A denial-of-service risk was identified in the draft files area, due to it not respecting user file upload limits. Moodle versions 3.10 to 3.10.3, 3.9 to 3.9.6, 3.8 to 3.8.8, 3.5 to 3.5.17 and earlier unsupported versions are affected. Se ha identificado un riesgo de denegación de servicio en el área de archivos borrador, debido a que no respeta los límites de subida de archivos de los usuarios. Están afectadas las versiones de Moodle versiones 3.10 a 3.10.3, 3.9 a 3.9.6, 3.8 a 3.8.8, 3.5 a 3.5.17 y version... • https://moodle.org/mod/forum/discuss.php?d=422310 • CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 6.1EPSS: 3%CPEs: 3EXPL: 0CVE-2021-32478
https://notcve.org/view.php?id=CVE-2021-32478
11 Mar 2022 — The redirect URI in the LTI authorization endpoint required extra sanitizing to prevent reflected XSS and open redirect risks. Moodle versions 3.10 to 3.10.3, 3.9 to 3.9.6, 3.8 to 3.8.8 and earlier unsupported versions are affected. El URI de redireccionamiento en el endpoint de autorización de LTI requería un saneamiento adicional para evitar los riesgos de tipo XSS reflejado y redireccionamiento abierto. Moodle versiones 3.10 a 3.10.3, 3.9 a 3.9.6, 3.8 a 3.8.8 y las versiones anteriores no soportadas está... • https://moodle.org/mod/forum/discuss.php?d=422314 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 8.8EPSS: 0%CPEs: 4EXPL: 0CVE-2022-0335
https://notcve.org/view.php?id=CVE-2022-0335
25 Jan 2022 — A flaw was found in Moodle in versions 3.11 to 3.11.4, 3.10 to 3.10.8, 3.9 to 3.9.11 and earlier unsupported versions. The "delete badge alignment" functionality did not include the necessary token check to prevent a CSRF risk. Se ha encontrado un fallo en Moodle en las versiones 3.11 hasta 3.11.4, versiones 3.10 hasta 3.10.8, versiones 3.9 hasta 3.9.11 y versiones anteriores no soportadas. La funcionalidad "delete badge alignment" no incluía la comprobación de tokens necesaria para evitar un riesgo de tipo... • https://bugzilla.redhat.com/show_bug.cgi?id=2043666 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 5.5EPSS: 0%CPEs: 4EXPL: 0CVE-2022-0333
https://notcve.org/view.php?id=CVE-2022-0333
25 Jan 2022 — A flaw was found in Moodle in versions 3.11 to 3.11.4, 3.10 to 3.10.8, 3.9 to 3.9.11 and earlier unsupported versions. The calendar:manageentries capability allowed managers to access or modify any calendar event, but should have been restricted from accessing user level events. Se ha encontrado un fallo en Moodle versiones 3.11 hasta 3.11.4, versiones 3.10 hasta 3.10.8, versiones 3.9 hasta 3.9.11 y versiones anteriores no soportadas. La capacidad calendar:manageentries permitía a administradores acceder o ... • https://bugzilla.redhat.com/show_bug.cgi?id=2043663 • CWE-863: Incorrect Authorization •
CVSS: 4.3EPSS: 0%CPEs: 4EXPL: 0CVE-2022-0334
https://notcve.org/view.php?id=CVE-2022-0334
25 Jan 2022 — A flaw was found in Moodle in versions 3.11 to 3.11.4, 3.10 to 3.10.8, 3.9 to 3.9.11 and earlier unsupported versions. Insufficient capability checks could lead to users accessing their grade report for courses where they did not have the required gradereport/user:view capability. Se encontró un fallo en Moodle versiones 3.11 hasta 3.11.4, versiones 3.10 hasta 3.10.8, versiones 3.9 hasta 3.9.11 y versiones anteriores no soportadas. Una comprobación insuficiente de las capacidades podía conllevar a que usuar... • https://bugzilla.redhat.com/show_bug.cgi?id=2043664 • CWE-668: Exposure of Resource to Wrong Sphere CWE-863: Incorrect Authorization •
CVSS: 5.0EPSS: 0%CPEs: 3EXPL: 0CVE-2021-40691
https://notcve.org/view.php?id=CVE-2021-40691
21 Jan 2022 — A session hijack risk was identified in the Shibboleth authentication plugin. Se ha identificado un riesgo de secuestro de sesión en el plugin de autenticación Shibboleth • https://bugzilla.redhat.com/show_bug.cgi?id=2043411 •