(URGENTE: Moodle 2.1.2, Moodle 2.0.5 y 1.9.14 Moodle ya están disponible
Hola Administradores de Moodle registrados!
(Este correo electrónico está saliendo a más de 75.000 administradores de Moodle registrados. Usted
Recibes este mensaje porque usted pidió para Moodle noticias sobre seguridad
cuando se registró un sitio Moodle. Si usted no quiere que estos mensajes de correo electrónico
a continuación, ver el final de este e-mail para información acerca de darse de baja)
Estoy escribiendo hoy en día para hacerle saber que Moodle 2.1.2, 2.0.5, 1.9.14 y se
disponible a través de los canales habituales de descarga abierta
( http://download.moodle.org , CVS o Git).
La notas de la versión completa está aquí:
* http://docs.moodle.org/dev/
* http://docs.moodle.org/dev/
* http://docs.moodle.org/dev/
CUESTIONES DE SEGURIDAD
Así como una larga lista de correcciones de errores, mejoras de rendimiento y
pulido, hay 15 problemas de seguridad que debe tener en cuenta.
Como administrador de Moodle registrados que le estamos dando aviso previo de estas
problemas para que tenga tiempo para corregirlos antes de su publicación más
ampliamente en http://moodle.org/security y difundirlos.
Para evitar dejar su sitio vulnerable es muy recomendable actualizar
sus sitios a la última versión de Moodle, tan pronto como sea posible.
Si no se puede actualizar, por favor consulte la siguiente lista con cuidado y
parche de su propio sistema o desactivar estas características.
Gracias como siempre a todos los involucrados en la información y de fijación de seguridad
problemas por todo su trabajo duro. Realmente es un esfuerzo de equipo y un
con más y más personas involucradas en todo momento.
Saludos y gracias por usar Moodle!
==============================
MSA-11-0018: Wiki páginas de referencia cuestión falsificación
Tema: CSRF en varios lugares
Gravedad / riesgo: grave
Versiones afectadas: <2.1.2, <2.0.5 (1.9.x no afectados)
Reportado por: Petr Škoda
El n °:. MDL-28724
Solución: actualizar a la última versión
Descripción:
Esta vulnerabilidad permite la falsificación de referencias cruzadas sitio dentro de los enlaces
en la Wiki.
==============================
MSA-11-0019: Wiki comentarios cross site scripting tema
Tema: XSS en los comentarios de Wiki
Gravedad / riesgo: grave
Versiones afectadas: <2.1.2, <2.0.5 (1.9.x no afectados)
Reportado por: Petr Škoda
El n °:. MDL-28726
Solución: actualizar a la última versión
Descripción:
El resultado de analizadores wiki no estaba limpia, lo que podría ser descubierto
y explotados, especialmente cuando se combina con CSRF
==============================
MSA-11-0020: Archivo problema de visibilidad
Tema: Servidor de archivos muestra todas las categorías y cursos, incluso
si un usuario no tiene acceso a ellos
Gravedad / riesgo: menor
Versiones afectadas: <2.1.2, <2.0.5 (1.9.x no afectados)
Reportado por: Ralf Hilgenstock
El n °:. MDL-27586
Solución: actualizar a la última versión
Descripción:
En los archivos del servidor, las áreas de categoría y por supuesto se está mostrando a
los usuarios que no tienen permiso para acceder a ellos
==============================
MSA-11-0021: repositorio de integración Box.net problema de autenticación
Tema: repositorio de Box.net tiene fallas de seguridad
Gravedad / riesgo: grave
Versiones afectadas: <2.1.2, <2.0.5 (1.9.x no afectados)
Reportado por: Alex Willen
El n °:. MDL-27289
Solución: actualizar a la última versión
Solución: Desactive el repositorio de Box.net
Descripción:
El plugin Box.net Box.net fue creado antes que lanzó un OAuth-como
autenticación, el cual requiere que el usuario introduzca su nombre de usuario y
contraseña en el sitio de moodle.
==============================
MSA-11-0022: Formas API constante problema
Tema: $ mform-> setConstant () no funciona como se esperaba
Gravedad / riesgo: grave
Versiones afectadas: <2.1.2, <2.0.5, <01/09/14
Reportado por: David Mudrak
El n °:. MDL-23872
Solución: actualizar a la última versión
Descripción:
Los valores de forma que se configuran como constantes pudieron ser alterados por los usuarios
cuando el formulario se envió
==============================
MSA-11-0023: MNET problema de validación SSL
Tema: El manejo incorrecto de openssl_verify () el código de retorno
Gravedad / riesgo: grave
Versiones afectadas: <2.1.2, <2.0.5, <01/09/14
Reportado por: David Mudrak
El n °:. MDL-29148
Solución: actualizar a la última versión
Solución: Desactive MNET
Descripción:
Moodle no es el manejo de estos códigos de retorno SSL correctamente y se
vulnerables a los ataques a distancia sin pasar por la validación.
==============================
MSA-11-0024: Sitio-centro de inscripción cuestión de la identidad
Tema: La columna se registration_hubs.secret diferentes
valor predeterminado para la actualización frente a instalar
Gravedad / riesgo: grave
Versiones afectadas: <2.1.2, <2.0.5 (1.9.x no afectados)
Reportado por: Colin Campbell
El n °:. MDL-27635
Solución: actualizar a la última versión
Solución: No utilice los centros de la comunidad
Descripción:
Sobre la instalación de un valor de secreto de los sitios de los centros no se está estableciendo.
==============================
MSA-11-0025: módulo de chat de fugas de información
Tema: Chat a conocer los nombres completos de todos los usuarios del sistema
incluidos los usuarios eliminados
Gravedad / riesgo: grave
Versiones afectadas: <2.1.2, <2.0.5 (1.9.x no afectados)
Reportado por: Petr Škoda
El n °:. MDL-27219
Solución: actualizar a la última versión
Solución: No utilice Chat en vivo
Descripción:
Los usuarios del chat podría sondear los nombres de los "usuarios beep'ing su ID de usuario
==============================
MSA-11-0026: Cookie-menos vulnerabilidad de la sesión
Tema: prevenir $ CFG-> usesid porque los hackers tratan de explotar
Gravedad / riesgo: menor
Versiones afectadas: <2.1.2, <2.0.5 (1.9.x también podrían ser vulnerables si
mal configurado)
Reportado por: Petr Škoda
El n °:. MDL-29312
Solución: actualizar a la última versión
Solución: no usar menos de galletas sesiones
Descripción:
Los $ CFG-> usesid agregado previamente para permitir un acceso más sencillo, pero
este ajuste es ahora ignorado para eliminar una vulnerabilidad potencial
==============================
MSA-11-0027: actualización de la vulnerabilidad de mensajería
Tema: sistema de mensajes refrescante puede causar ilimitada
consultas y el ataque DDos
Gravedad / riesgo: grave
Versiones afectadas: <01/09/14 (2.x no se ve afectada)
Reportado por: Xavier Paz
El n °:. MDL-29311
Solución: actualizar a 1.9.14
Solución: aplicar el parche proporcionado
Descripción:
Los usuarios podrían cambiar el parámetro de espera de mensaje / refresh.php a cero
para causar una denegación de servicio.
==============================
MSA-11-0028: Curso de edición de la sección de inyección de vulnerabilidad
Tema: Potencial XSS: los valores de impresión editsection.html
directamente desde data_submitted ()
Gravedad / riesgo: menor
Versiones afectadas: <01/09/14 (2.x no se ve afectada)
Reportado por: Aaron Barnes
El n °:. MDL-28722
Solución: actualizar a 1.9.14
Descripción:
Curso sección datos del formulario de edición estaba siendo utilizado sin
filtrada, lo que podría ser explotada por un ataque de inyección
==============================
MSA-11-0029: la protección de bases de datos de la inyección fortalecido
Tema: Magic cita el endurecimiento de 1,9
Gravedad / riesgo: grave
Versiones afectadas: <01/09/14 (2.x no se ve afectada)
Reportado por: Petr Škoda
El n °:. MDL-29033
Solución: actualizar a 1.9.14
Descripción:
Filtrado ha sido añadido a las funciones de base de datos diferentes para evitar
amenazas imprevistas de la inyección
==============================
MSA-11-0030: vulnerabilidad de la sección Wiki
Tema: XSS a través de 'sección' del parámetro
Gravedad / riesgo: grave
Versiones afectadas: <2.1.2, <2.0.5 (1.9.x no afectados)
Reportado por: Petr Škoda
El n °:. MDL-28725
Solución: actualizar a la última versión
Descripción:
XSS es posible a través de la "sección" de los parámetros.
==============================
MSA-11-0031: pérdida potencial de información personal
Tema: mod / forum / user.php exploses datos de los usuarios
Gravedad / riesgo: menor
Versiones afectadas: <2.1.2, <2.0.5, <01/09/14
Reportado por: Rossiani Wijaya
El n °:. MDL-28615
Solución: actualizar a la última versión
Descripción:
Nombres de los usuarios sólo se debe mostrar a otros estudiantes en el mismo
curso o para los administradores.
==============================
MSA-11-0032: problema mundial de autenticación de búsqueda
Tema: usuario invitado puede ejecutar la búsqueda mundial mediante la introducción de
URL directa
Gravedad / riesgo: menor
Versiones afectadas: <2.1.2, <2.0.5 (1.9.x no afectados)
Reportado por: Tatsuya Shirai
El n °:. MDL-19575
Solución: actualizar a la última versión
Descripción:
Después de iniciar sesión en Moodle como invitado, el usuario podría ejecutar una búsqueda global.
-
/ / / Moodle - software de código abierto para el aprendizaje colaborativo
/ / /
/ / / Software libre, comunidad, información: http://moodle.org
Servicios / / / Soporte comercial y otros: http://moodle.com
-
Usted está recibiendo este email porque se ha registrado un sitio Moodle con Moodle.org
y optó por añadir a esta lista de bajo volumen de las notificaciones de seguridad y otros
Moodle importantes anuncios relacionados con los administradores de Moodle.
Para darse de baja puede volver a registrar su sitio (como antes) y asegúrese de que
a su vez la opción de correo electrónico fuera en el formulario de inscripción. También puede enviar
un mensaje en blanco a sympa@lists.moodle.org con "securityalerts darse de baja"
como el tema (de la dirección de correo electrónico que está suscrito).
Ver http://lists.moodle.org/info/
---------- Forwarded message ----------
From: Martin Dougiamas <martin@moodle.com>
Date: 2011/10/10
Subject: [securityalerts] URGENT: Moodle 2.1.2, Moodle 2.0.5 and Moodle 1.9.14 are now available.
To: securityalerts <securityalerts@lists.moodle.
Hello registered Moodle Admins!
(This email is going out to over 75,000 registered Moodle admins. You
are receiving this email because you asked for Moodle security news
when you registered a Moodle site. If you don't want these emails
then see the very end of this email for info about unsubscribing)
I'm writing today to let you know that Moodle 2.1.2, 2.0.5, and 1.9.14 are
available via the usual open download channels
(http://download.moodle.org, CVS or Git).
The full release notes are here:
* http://docs.moodle.org/dev/
* http://docs.moodle.org/dev/
* http://docs.moodle.org/dev/
SECURITY ISSUES
As well as a long list of bug fixes, performance improvements and
polishing, there are 15 security issues you should be aware of.
As a registered Moodle admin we are giving you advance notice of these
issues so you have some time to fix them before we publish them more
widely on http://moodle.org/security and publicize them.
To avoid leaving your site vulnerable we highly recommend you upgrade
your sites to the latest Moodle version as soon as you can.
If you cannot upgrade then please check the following list carefully and
patch your own system or switch off those features.
Thanks as always to EVERYONE involved in reporting and fixing security
issues for all their hard work. It really is a team effort and one
with more and more people involved all the time.
Cheers and thanks for using Moodle!
==============================
MSA-11-0018: Wiki pages reference forgery issue
Topic: CSRF in several places
Severity/Risk: Serious
Versions affected: < 2.1.2, < 2.0.5 (1.9.x not affected)
Reported by: Petr Škoda
Issue no.: MDL-28724
Solution: upgrade to latest version
Description:
This vulnerability allowed cross site reference forgery within links
in the Wiki.
==============================
MSA-11-0019: Wiki comments cross site scripting issue
Topic: XSS in Wiki comments
Severity/Risk: Serious
Versions affected: < 2.1.2, < 2.0.5 (1.9.x not affected)
Reported by: Petr Škoda
Issue no.: MDL-28726
Solution: upgrade to latest version
Description:
The result of wiki parsers was not cleaned, which could be discovered
and exploited especially when combined with CSRF
==============================
MSA-11-0020: File visibility issue
Topic: Server files shows all categories and courses even
if a user don't have access to them
Severity/Risk: Minor
Versions affected: < 2.1.2, < 2.0.5 (1.9.x not affected)
Reported by: Ralf Hilgenstock
Issue no.: MDL-27586
Solution: upgrade to latest version
Description:
In server files, the category and course areas were being shown to
users who do not have permission to access them
==============================
MSA-11-0021: Box.net repository integration authentication issue
Topic: Box.net repository has security flaws
Severity/Risk: Serious
Versions affected: < 2.1.2, < 2.0.5 (1.9.x not affected)
Reported by: Alex Willen
Issue no.: MDL-27289
Solution: upgrade to latest version
Workaround: Disable the Box.net repository
Description:
The Box.net plugin was created before Box.net released an OAuth-like
authentication, which requires a user to enter their username and
password in moodle site.
==============================
MSA-11-0022: Forms API constant issue
Topic: $mform->setConstant() does not work as expected
Severity/Risk: Serious
Versions affected: < 2.1.2, < 2.0.5, < 1.9.14
Reported by: David Mudrak
Issue no.: MDL-23872
Solution: upgrade to latest version
Description:
Form values that are set as constants were able to be altered by users
when the form was submitted
==============================
MSA-11-0023: MNET SSL validation issue
Topic: Incorrect handling of openssl_verify() return code
Severity/Risk: Serious
Versions affected: < 2.1.2, < 2.0.5, < 1.9.14
Reported by: David Mudrak
Issue no.: MDL-29148
Solution: upgrade to latest version
Workaround: Disable MNET
Description:
Moodle was not handling these SSL return codes correctly and was
vulnerable to remote attacks bypassing validation.
==============================
MSA-11-0024: Site-hub registration identity issue
Topic: Column registration_hubs.secret gets different
default value for upgrade versus install
Severity/Risk: Serious
Versions affected: < 2.1.2, < 2.0.5 (1.9.x not affected)
Reported by: Colin Campbell
Issue no.: MDL-27635
Solution: upgrade to latest version
Workaround: Do not use community hubs
Description:
On installation a sites secret value for hubs was not being set.
==============================
MSA-11-0025: Chat module information leak
Topic: Chat disclosed full names of all system users
including deleted users
Severity/Risk: Serious
Versions affected: < 2.1.2, < 2.0.5 (1.9.x not affected)
Reported by: Petr Škoda
Issue no.: MDL-27219
Solution: upgrade to latest version
Workaround: Do not use Chat
Description:
Chat users could probe users' names by 'beep'ing their user ID
==============================
MSA-11-0026: Cookie-less session vulnerability
Topic: prevent $CFG->usesid because hackers try to exploit it
Severity/Risk: Minor
Versions affected: < 2.1.2, < 2.0.5 (1.9.x could also be vulnerable if
misconfigured)
Reported by: Petr Škoda
Issue no.: MDL-29312
Solution: upgrade to latest version
Workaround: Don't use cookie-less sessions
Description:
The $CFG->usesid was added previously to allow simpler access, but
this setting is now ignored to remove a potential vulnerability
==============================
MSA-11-0027: Messaging refresh vulnerability
Topic: Message refreshing system may cause unlimited
queries and DDos attack
Severity/Risk: Serious
Versions affected: < 1.9.14 (2.x not affected)
Reported by: Xavier Paz
Issue no.: MDL-29311
Solution: upgrade to 1.9.14
Workaround: apply patch provided
Description:
Users could change the wait parameter from message/refresh.php to zero
to cause a denial of service attack.
==============================
MSA-11-0028: Course section editing injection vulnerability
Topic: Potential XSS: editsection.html print values
directly from data_submitted()
Severity/Risk: Minor
Versions affected: < 1.9.14 (2.x not affected)
Reported by: Aaron Barnes
Issue no.: MDL-28722
Solution: upgrade to 1.9.14
Description:
Course section editing form data was being used without being
filtered, which could be exploited by an injection attack
==============================
MSA-11-0029: Database injection protection strengthened
Topic: Magic quotes hardening of 1.9
Severity/Risk: Serious
Versions affected: < 1.9.14 (2.x not affected)
Reported by: Petr Škoda
Issue no.: MDL-29033
Solution: upgrade to 1.9.14
Description:
Filtering has been added to various DB functions to avoid
unanticipated injection threats
==============================
MSA-11-0030: Wiki section vulnerability
Topic: XSS through 'section' parameter
Severity/Risk: Serious
Versions affected: < 2.1.2, < 2.0.5 (1.9.x not affected)
Reported by: Petr Škoda
Issue no.: MDL-28725
Solution: upgrade to latest version
Description:
XSS was possible through the 'section' parameter.
==============================
MSA-11-0031: Potential personal information leak
Topic: mod/forum/user.php exploses user details
Severity/Risk: Minor
Versions affected: < 2.1.2, < 2.0.5, < 1.9.14
Reported by: Rossiani Wijaya
Issue no.: MDL-28615
Solution: upgrade to latest version
Description:
Users' names should only be displayed to other students in the same
course or to administrators.
==============================
MSA-11-0032: Global search authentication issue
Topic: Guest user can execute global search by inputting
URL directly
Severity/Risk: Minor
Versions affected: < 2.1.2, < 2.0.5 (1.9.x not affected)
Reported by: Tatsuya Shirai
Issue no.: MDL-19575
Solution: upgrade to latest version
Description:
After logged in to Moodle as a guest, the user could execute a Global search.
--
/// Moodle - open-source software for collaborative learning
///
/// Free software, community, information: http://moodle.org
/// Commercial support and other services: http://moodle.com
--
You are receiving this email because you registered a Moodle site with Moodle.org
and chose to be added to this low-volume list of security notifications and other
important Moodle-related announcements for Moodle administrators.
To unsubscribe you can re-register your site (as above) and make sure you
turn the email option OFF in the registration form. You can also send
a blank email to sympa@lists.moodle.org with "unsubscribe securityalerts"
as the subject (from the email address that is subscribed).
See http://lists.moodle.org/info/
From: Martin Dougiamas <martin@moodle.com>
Date: 2011/10/10
Subject: [securityalerts] URGENT: Moodle 2.1.2, Moodle 2.0.5 and Moodle 1.9.14 are now available.
To: securityalerts <securityalerts@lists.moodle.
Hello registered Moodle Admins!
(This email is going out to over 75,000 registered Moodle admins. You
are receiving this email because you asked for Moodle security news
when you registered a Moodle site. If you don't want these emails
then see the very end of this email for info about unsubscribing)
I'm writing today to let you know that Moodle 2.1.2, 2.0.5, and 1.9.14 are
available via the usual open download channels
(http://download.moodle.org, CVS or Git).
The full release notes are here:
* http://docs.moodle.org/dev/
* http://docs.moodle.org/dev/
* http://docs.moodle.org/dev/
SECURITY ISSUES
As well as a long list of bug fixes, performance improvements and
polishing, there are 15 security issues you should be aware of.
As a registered Moodle admin we are giving you advance notice of these
issues so you have some time to fix them before we publish them more
widely on http://moodle.org/security and publicize them.
To avoid leaving your site vulnerable we highly recommend you upgrade
your sites to the latest Moodle version as soon as you can.
If you cannot upgrade then please check the following list carefully and
patch your own system or switch off those features.
Thanks as always to EVERYONE involved in reporting and fixing security
issues for all their hard work. It really is a team effort and one
with more and more people involved all the time.
Cheers and thanks for using Moodle!
==============================
MSA-11-0018: Wiki pages reference forgery issue
Topic: CSRF in several places
Severity/Risk: Serious
Versions affected: < 2.1.2, < 2.0.5 (1.9.x not affected)
Reported by: Petr Škoda
Issue no.: MDL-28724
Solution: upgrade to latest version
Description:
This vulnerability allowed cross site reference forgery within links
in the Wiki.
==============================
MSA-11-0019: Wiki comments cross site scripting issue
Topic: XSS in Wiki comments
Severity/Risk: Serious
Versions affected: < 2.1.2, < 2.0.5 (1.9.x not affected)
Reported by: Petr Škoda
Issue no.: MDL-28726
Solution: upgrade to latest version
Description:
The result of wiki parsers was not cleaned, which could be discovered
and exploited especially when combined with CSRF
==============================
MSA-11-0020: File visibility issue
Topic: Server files shows all categories and courses even
if a user don't have access to them
Severity/Risk: Minor
Versions affected: < 2.1.2, < 2.0.5 (1.9.x not affected)
Reported by: Ralf Hilgenstock
Issue no.: MDL-27586
Solution: upgrade to latest version
Description:
In server files, the category and course areas were being shown to
users who do not have permission to access them
==============================
MSA-11-0021: Box.net repository integration authentication issue
Topic: Box.net repository has security flaws
Severity/Risk: Serious
Versions affected: < 2.1.2, < 2.0.5 (1.9.x not affected)
Reported by: Alex Willen
Issue no.: MDL-27289
Solution: upgrade to latest version
Workaround: Disable the Box.net repository
Description:
The Box.net plugin was created before Box.net released an OAuth-like
authentication, which requires a user to enter their username and
password in moodle site.
==============================
MSA-11-0022: Forms API constant issue
Topic: $mform->setConstant() does not work as expected
Severity/Risk: Serious
Versions affected: < 2.1.2, < 2.0.5, < 1.9.14
Reported by: David Mudrak
Issue no.: MDL-23872
Solution: upgrade to latest version
Description:
Form values that are set as constants were able to be altered by users
when the form was submitted
==============================
MSA-11-0023: MNET SSL validation issue
Topic: Incorrect handling of openssl_verify() return code
Severity/Risk: Serious
Versions affected: < 2.1.2, < 2.0.5, < 1.9.14
Reported by: David Mudrak
Issue no.: MDL-29148
Solution: upgrade to latest version
Workaround: Disable MNET
Description:
Moodle was not handling these SSL return codes correctly and was
vulnerable to remote attacks bypassing validation.
==============================
MSA-11-0024: Site-hub registration identity issue
Topic: Column registration_hubs.secret gets different
default value for upgrade versus install
Severity/Risk: Serious
Versions affected: < 2.1.2, < 2.0.5 (1.9.x not affected)
Reported by: Colin Campbell
Issue no.: MDL-27635
Solution: upgrade to latest version
Workaround: Do not use community hubs
Description:
On installation a sites secret value for hubs was not being set.
==============================
MSA-11-0025: Chat module information leak
Topic: Chat disclosed full names of all system users
including deleted users
Severity/Risk: Serious
Versions affected: < 2.1.2, < 2.0.5 (1.9.x not affected)
Reported by: Petr Škoda
Issue no.: MDL-27219
Solution: upgrade to latest version
Workaround: Do not use Chat
Description:
Chat users could probe users' names by 'beep'ing their user ID
==============================
MSA-11-0026: Cookie-less session vulnerability
Topic: prevent $CFG->usesid because hackers try to exploit it
Severity/Risk: Minor
Versions affected: < 2.1.2, < 2.0.5 (1.9.x could also be vulnerable if
misconfigured)
Reported by: Petr Škoda
Issue no.: MDL-29312
Solution: upgrade to latest version
Workaround: Don't use cookie-less sessions
Description:
The $CFG->usesid was added previously to allow simpler access, but
this setting is now ignored to remove a potential vulnerability
==============================
MSA-11-0027: Messaging refresh vulnerability
Topic: Message refreshing system may cause unlimited
queries and DDos attack
Severity/Risk: Serious
Versions affected: < 1.9.14 (2.x not affected)
Reported by: Xavier Paz
Issue no.: MDL-29311
Solution: upgrade to 1.9.14
Workaround: apply patch provided
Description:
Users could change the wait parameter from message/refresh.php to zero
to cause a denial of service attack.
==============================
MSA-11-0028: Course section editing injection vulnerability
Topic: Potential XSS: editsection.html print values
directly from data_submitted()
Severity/Risk: Minor
Versions affected: < 1.9.14 (2.x not affected)
Reported by: Aaron Barnes
Issue no.: MDL-28722
Solution: upgrade to 1.9.14
Description:
Course section editing form data was being used without being
filtered, which could be exploited by an injection attack
==============================
MSA-11-0029: Database injection protection strengthened
Topic: Magic quotes hardening of 1.9
Severity/Risk: Serious
Versions affected: < 1.9.14 (2.x not affected)
Reported by: Petr Škoda
Issue no.: MDL-29033
Solution: upgrade to 1.9.14
Description:
Filtering has been added to various DB functions to avoid
unanticipated injection threats
==============================
MSA-11-0030: Wiki section vulnerability
Topic: XSS through 'section' parameter
Severity/Risk: Serious
Versions affected: < 2.1.2, < 2.0.5 (1.9.x not affected)
Reported by: Petr Škoda
Issue no.: MDL-28725
Solution: upgrade to latest version
Description:
XSS was possible through the 'section' parameter.
==============================
MSA-11-0031: Potential personal information leak
Topic: mod/forum/user.php exploses user details
Severity/Risk: Minor
Versions affected: < 2.1.2, < 2.0.5, < 1.9.14
Reported by: Rossiani Wijaya
Issue no.: MDL-28615
Solution: upgrade to latest version
Description:
Users' names should only be displayed to other students in the same
course or to administrators.
==============================
MSA-11-0032: Global search authentication issue
Topic: Guest user can execute global search by inputting
URL directly
Severity/Risk: Minor
Versions affected: < 2.1.2, < 2.0.5 (1.9.x not affected)
Reported by: Tatsuya Shirai
Issue no.: MDL-19575
Solution: upgrade to latest version
Description:
After logged in to Moodle as a guest, the user could execute a Global search.
--
/// Moodle - open-source software for collaborative learning
///
/// Free software, community, information: http://moodle.org
/// Commercial support and other services: http://moodle.com
--
You are receiving this email because you registered a Moodle site with Moodle.org
and chose to be added to this low-volume list of security notifications and other
important Moodle-related announcements for Moodle administrators.
To unsubscribe you can re-register your site (as above) and make sure you
turn the email option OFF in the registration form. You can also send
a blank email to sympa@lists.moodle.org with "unsubscribe securityalerts"
as the subject (from the email address that is subscribed).
See http://lists.moodle.org/info/
No hay comentarios:
Publicar un comentario