by Michael Hawkins. ID numbers displayed when bulk allocating markers to assignments required additional sanitizing to prevent a stored XSS risk.Severity/Risk:MinorVersions affected:4.0, 3.11 to 3.11.6, 3.10 to 3.10.10, 3.9 to 3.9.13 and earlier unsupported versionsVersions fixed:4.0.1, 3.11.7, 3.10.11 and 3.9.14Reported by:Paul HoldenCVE identifier:CVE-2022-30596Changes (master):http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-74204Tracker issue:MDL-74204
More info:
https://moodle.org/mod/forum/discuss.php?d=434578&parent=1748722
by Michael Hawkins. Global search results could include author information on some activities where a user may not otherwise have access to it.Severity/Risk:MinorVersions affected:4.0, 3.11 to 3.11.6, 3.10 to 3.10.10, 3.9 to 3.9.13 and earlier unsupported versionsVersions fixed:4.0.1, 3.11.7, 3.10.11 and 3.9.14Reported by:CatalinaCVE identifier:CVE-2022-30598Changes (master):http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-71623Tracker issue:MDL-71623 Global
More info:
https://moodle.org/mod/forum/discuss.php?d=434580&parent=1748724
Linux Kernel vulnerability CVE-2021-23134 Security Advisory Security Advisory Description Use After Free vulnerability in nfc sockets in the Linux Kernel before 5.12.4 allows local attackers to ...
More info:
https://support.f5.com/csp/article/K52102651?utm_source=f5support&utm_medium=RSS
di Michael Hawkins. Insufficient capability checks made it possible to fetch other users calendar action events.Severity/Risk:MinorVersions affected:3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versionsVersions fixed:3.11.4, 3.10.8 and 3.9.11Reported by:0xkasperCVE identifier:CVE-2021-43560Changes (master):http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-71918Tracker issue:MDL-71918 IDOR in a calendar web service allows fetching of
More info:
https://moodle.org/mod/forum/discuss.php?d=429100&parent=1726807
di Michael Hawkins. An SQL injection risk was identified in the h5p activity web service responsible for fetching user attempt data.Severity/Risk:SeriousVersions affected:3.11 to 3.11.4Versions fixed:3.11.5Reported by:Paul HoldenCVE identifier:CVE-2022-0332Changes (master):http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-72573Tracker issue:MDL-72573 SQL injection risk in code fetching h5p activity user attempts
More info:
https://moodle.org/mod/forum/discuss.php?d=431099&parent=1734813
di Michael Hawkins. The calendar:manageentries capability allowed managers to access or modify any calendar event, but should have been restricted from accessing user level events.Severity/Risk:MinorVersions affected:3.11 to 3.11.4, 3.10 to 3.10.8, 3.9 to 3.9.11 and earlier unsupported versionsVersions fixed:3.11.5, 3.10.9 and 3.9.12Reported by:oct0pus7CVE identifier:CVE-2022-0333Changes (master):http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-71239Tracker
More info:
https://moodle.org/mod/forum/discuss.php?d=431100&parent=1734814
di Michael Hawkins. Insufficient capability checks could lead to users accessing their grade report for courses where they did not have the required gradereport/user:view capability.Severity/Risk:MinorVersions affected:3.11 to 3.11.4, 3.10 to 3.10.8, 3.9 to 3.9.11 and earlier unsupported versionsVersions fixed:3.11.5, 3.10.9 and 3.9.12Reported by:Deds CastilloCVE identifier:CVE-2022-0334Changes
More info:
https://moodle.org/mod/forum/discuss.php?d=431102&parent=1734816
di Michael Hawkins. An SQL injection risk was identified in Badges code relating to configuring criteria. Access to the relevant capability was limited to teachers and managers by default.NOTE: Please pay particular attention to this fix. Information was recently released online about this vulnerability by third parties, so please upgrade or patch as soon as you are able to. We prepared the patch for this as soon as we became aware of the issue, to ensure a fix was available for this release.It
More info:
https://moodle.org/mod/forum/discuss.php?d=432947&parent=1742073
di Michael Hawkins. The "delete badge alignment" functionality did not include the necessary token check to prevent a CSRF risk.Severity/Risk:SeriousVersions affected:3.11 to 3.11.4, 3.10 to 3.10.8, 3.9 to 3.9.11 and earlier unsupported versionsVersions fixed:3.11.5, 3.10.9 and 3.9.12Reported by:OstapbenderCVE identifier:CVE-2022-0335Changes (master):http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-72367Tracker issue:MDL-72367 CSRF risk in badge
More info:
https://moodle.org/mod/forum/discuss.php?d=431103&parent=1734817
di Michael Hawkins. Users with the capability to configure badge criteria (teachers and managers by default) were able to configure course badges with profile field criteria, which should only be available for site badges.Severity/Risk:MinorVersions affected:3.11 to 3.11.5, 3.10 to 3.10.9, 3.9 to 3.9.12 and earlier unsupported versionsVersions fixed:3.11.6, 3.10.10 and 3.9.13Reported by:Andrew LyonsWorkaround:Remove the moodle/badges:configurecriteria capability from users to prevent them
More info:
https://moodle.org/mod/forum/discuss.php?d=432949&parent=1742075
