CVSS: 9.0EPSS: 0%CPEs: 8EXPL: 0CVE-2023-28329 – Moodle: authenticated sql injection via availability check
https://notcve.org/view.php?id=CVE-2023-28329
23 Mar 2023 — Insufficient validation of profile field availability condition resulted in an SQL injection risk (by default only available to teachers and managers). • https://bugzilla.redhat.com/show_bug.cgi?id=2179406 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 4.3EPSS: 0%CPEs: 8EXPL: 0CVE-2023-1402 – Moodle: course participation report shows roles the user should not see
https://notcve.org/view.php?id=CVE-2023-1402
23 Mar 2023 — The course participation report required additional checks to prevent roles being displayed which the user did not have access to view. • https://bugzilla.redhat.com/show_bug.cgi?id=2179427 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-668: Exposure of Resource to Wrong Sphere •
CVSS: 10.0EPSS: 0%CPEs: 9EXPL: 0CVE-2023-28333 – Moodle: pix helper potential mustache code injection risk
https://notcve.org/view.php?id=CVE-2023-28333
23 Mar 2023 — The Mustache pix helper contained a potential Mustache injection risk if combined with user input (note: This did not appear to be implemented/exploitable anywhere in the core Moodle LMS). • https://bugzilla.redhat.com/show_bug.cgi?id=2179422 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 10.0EPSS: 0%CPEs: 2EXPL: 0CVE-2023-28335 – Moodle: csrf risk in resetting all templates of a database activity
https://notcve.org/view.php?id=CVE-2023-28335
23 Mar 2023 — The link to reset all templates of a database activity did not include the necessary token to prevent a CSRF risk. • https://bugzilla.redhat.com/show_bug.cgi?id=2179424 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 6.8EPSS: 0%CPEs: 8EXPL: 0CVE-2023-28330 – Moodle: authenticated arbitrary file read through malformed backup file
https://notcve.org/view.php?id=CVE-2023-28330
23 Mar 2023 — Insufficient sanitizing in backup resulted in an arbitrary file read risk. The capability to access this feature is only available to teachers, managers and admins by default. • https://bugzilla.redhat.com/show_bug.cgi?id=2179412 • CWE-20: Improper Input Validation •
CVSS: 6.4EPSS: 0%CPEs: 2EXPL: 0CVE-2023-23922 – Moodle: reflected xss risk in blog search
https://notcve.org/view.php?id=CVE-2023-23922
17 Feb 2023 — The vulnerability was found Moodle which exists due to insufficient sanitization of user-supplied data in blog search. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website. This flaw allows a remote attacker to perform cross-site scripting (XSS) attacks. • http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-76861 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.5EPSS: 0%CPEs: 4EXPL: 0CVE-2023-23923 – Moodle: possible to set the preferred "start page" of other users
https://notcve.org/view.php?id=CVE-2023-23923
17 Feb 2023 — The vulnerability was found Moodle which exists due to insufficient limitations on the "start page" preference. A remote attacker can set that preference for another user. The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality. • http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-76862 • CWE-284: Improper Access Control •
CVSS: 6.4EPSS: 0%CPEs: 4EXPL: 0CVE-2023-23921 – Moodle: reflected xss risk in some returnurl parameters
https://notcve.org/view.php?id=CVE-2023-23921
17 Feb 2023 — The vulnerability was found Moodle which exists due to insufficient sanitization of user-supplied data in some returnurl parameters. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website. This flaw allows a remote attacker to perform cross-site scripting (XSS) attacks. • http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-76810 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.4EPSS: 0%CPEs: 7EXPL: 0CVE-2022-45152
https://notcve.org/view.php?id=CVE-2022-45152
25 Nov 2022 — A blind Server-Side Request Forgery (SSRF) vulnerability was found in Moodle. This flaw exists due to insufficient validation of user-supplied input in LTI provider library. The library does not utilise Moodle's inbuilt cURL helper, which resulted in a blind SSRF risk. An attacker can send a specially crafted HTTP request and trick the application to initiate requests to arbitrary systems. This vulnerability allows a remote attacker to perform SSRF attacks. • http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-71920 • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 5.5EPSS: 0%CPEs: 5EXPL: 0CVE-2022-45151
https://notcve.org/view.php?id=CVE-2022-45151
23 Nov 2022 — The stored-XSS vulnerability was discovered in Moodle which exists due to insufficient sanitization of user-supplied data in several "social" user profile fields. An attacker could inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website. La vulnerabilidad XSS almacenada se descubrió en Moodle y existe debido a una sanitización insuficiente de los datos proporcionados por el usuario en varios campos de perfil de usuario "social". Un atacante podría inyectar y ejec... • http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-76131 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •