====================================================================

                             CERT-Renater

                 Note d'Information No. 2020/VULN139
_____________________________________________________________________

DATE                : 16/03/2020

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running Moodle versions prior to 3.8.2,
                                       3.7.5, 3.6.9, 3.5.11.

=====================================================================
https://moodle.org/mod/forum/discuss.php?d=398352
https://moodle.org/mod/forum/discuss.php?d=398351
https://moodle.org/mod/forum/discuss.php?d=398350
_____________________________________________________________________

MSA-20-0004: Admin PHP unit webrunner tool requires additional input
escaping
par Michael Hawkins, lundi 16 mars 2020, 13:17


Insufficient input escaping was applied to the PHP unit webrunner admin
tool.

NOTE: It is important to note that this update is only flagged as a
precautionary measure, as it may provide limited CLI access to Moodle
site admins. This may be considered a security risk in circumstances
where admins do not ordinarily have access to the server CLI and/or in
some hosting situations where site admins are not considered trusted
users. This tool will also be removed entirely from Moodle 3.9.


Severity/Risk:          Minor
Versions affected:      3.8 to 3.8.1, 3.7 to 3.7.4, 3.6 to 3.6.8, 3.5 to
                         3.5.10 and earlier unsupported versions
Versions fixed:         3.8.2, 3.7.5, 3.6.9 and 3.5.11
Reported by:            Brendan Heywood
CVE identifier:         CVE-2020-1756
Changes (master):
http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-67726
Tracker issue:          MDL-67726 Admin PHP unit webrunner tool requires
                         additional input escaping

_____________________________________________________________________


MSA-20-0003: IP addresses can be spoofed using X-Forwarded-For
par Michael Hawkins, lundi 16 mars 2020, 13:09


X-Forwarded-For headers could be used to spoof a user's IP, in order to
bypass remote address checks.

PATCH NOTE: For user IPs to be checked (and logged) accurately after
this patch is applied, sites using multiple levels of reverse
proxies/balancers that append to the X-Forwarded-For header will need to
configure the new "reverseproxyignore" setting. This ensures the IPs of
the later proxies are ignored in favour of the user's IP.


Severity/Risk:          Serious
Versions affected:      3.8 to 3.8.1, 3.7 to 3.7.4, 3.6 to 3.6.8, 3.5 to
                         3.5.10 and earlier unsupported versions
Versions fixed:         3.8.2, 3.7.5, 3.6.9 and 3.5.11
Reported by:            Brendan Heywood
CVE identifier:         CVE-2020-1755
Changes (master):
http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-67861
Tracker issue:          MDL-67861 IP addresses can be spoofed using
                         X-Forwarded-For

_____________________________________________________________________


MSA-20-0002: Grade history report does not respect Separate groups mode
in the course settings
par Michael Hawkins, lundi 16 mars 2020, 13:05


Users viewing the grade history report without the 'access all groups'
capability were not restricted to viewing grades of users within their
own groups.


Severity/Risk:          Minor
Versions affected:      3.8 to 3.8.1, 3.7 to 3.7.4, 3.6 to 3.6.8, 3.5 to
                         3.5.10 and earlier unsupported versions
Versions fixed:         3.8.2, 3.7.5, 3.6.9 and 3.5.11
Reported by:            Tim Hunt
CVE identifier:         CVE-2020-1754
Changes (master):
http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-56287
Tracker issue:          MDL-56287 Grade history report does not respect
                         Separate groups mode in the course settings

=========================================================
+ CERT-RENATER        | tel : 01-53-94-20-44            +
+ 23/25 Rue Daviel    | fax : 01-53-94-20-41            +
+ 75013 Paris         | email:cert@support.renater.fr   +
=========================================================