Recently, Moodle released security announcements to warn the user about three flaws that exist in Moodle.
The vulnerabilities details are below
- MSA-18-0001: Server Side Request Forgery in the filepicker
By substituting the source URL in the filepicker AJAX request authenticated users are able to retrieve and view any URL. We classify this issue as serious because some cloud hosting providers contain internal resources that can expose data and compromise a server
Severity/Risk: Serious
Versions affected: 3.4, 3.3 to 3.3.3, 3.2 to 3.2.6, 3.1 to 3.1.9 and earlier unsupported versions
Versions fixed: 3.4.1, 3.3.4, 3.2.7 and 3.1.10 - MSA-18-0004: XSS in calendar event name
It is possible to inject javascript in the event name in the calendar block. Normally capability to create events is only given to trusted users (such as teachers), however, it is not marked as having XSS risk, therefore it is considered a security issue.Severity/Risk: Minor
Versions affected: 3.3 to 3.3.3, 3.2 to 3.2.6, 3.1 to 3.1.9 and earlier unsupported versions
Versions fixed: 3.3.4, 3.2.7 and 3.1.10
Reported by: Rubens Brandao
CVE identifier: CVE-2018-1045 - MSA-18-0003: Privilege escalation in quiz web services
Quiz web services allow students to see quiz results when it is prohibited in the settings. This web service is used by the mobile appSeverity/Risk: Minor
Versions affected: 3.4, 3.3 to 3.3.3, 3.2 to 3.2.6 and 3.1 to 3.1.9
Versions fixed: 3.4.1, 3.3.4, 3.2.7 and 3.1.10
Reported by: Chirine Nassar
CVE identifier: CVE-2018-1044
Source: moodle
