====================================================================== CERT-Renater Note d'Information No. 2024/VULN535 _____________________________________________________________________ DATE : 17/12/2024 HARDWARE PLATFORM(S): / OPERATING SYSTEM(S): Systems running Suricata versions prior to 4.5.1, 4.4.5, 4.3.9, 4.1.15. ===================================================================== https://moodle.org/mod/forum/discuss.php?d=464554 https://moodle.org/mod/forum/discuss.php?d=464555 https://moodle.org/mod/forum/discuss.php?d=464556 https://moodle.org/mod/forum/discuss.php?d=464557 https://moodle.org/mod/forum/discuss.php?d=464558 https://moodle.org/mod/forum/discuss.php?d=464559 _____________________________________________________________________ MSA-24-0051: Unprotected access to sensitive information via learning plan web service par Michael Hawkins, mardi 17 décembre 2024, 02:51 Insufficient capability checks in a learning plan web service could result in users having the ability to retrieve information they did not have permission to access (such as users' names). Severity/Risk: Serious Versions affected: 4.5, 4.4 to 4.4.4, 4.3 to 4.3.8, 4.1 to 4.1.14 and earlier unsupported versions Versions fixed: 4.5.1, 4.4.5, 4.3.9 and 4.1.15 Reported by: lUcgryy CVE identifier: CVE-2024-55643 Changes (main): http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-83921 Tracker issue: MDL-83921 Unprotected access to sensitive information via learning plan web service _____________________________________________________________________ MSA-24-0052: Tag index page displays other users tagged with the selected tag par Michael Hawkins, mardi 17 décembre 2024, 02:52 Insufficient checks meant users could see users tagged with a tag, regardless of whether they had access to view the users' profiles. Severity/Risk: Minor Versions affected: 4.5, 4.4 to 4.4.4, 4.3 to 4.3.8, 4.1 to 4.1.14 and earlier unsupported versions Versions fixed: 4.5.1, 4.4.5, 4.3.9 and 4.1.15 Reported by: Frederik Milling Pytlick CVE identifier: CVE-2024-55644 Changes (main): http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-82963 Tracker issue: MDL-82963 Tag index page displays other users tagged with the selected tag _____________________________________________________________________ MSA-24-0053: Email change confirmation token available via preference par Michael Hawkins, mardi 17 décembre 2024, 02:53 Nombre de réponses : 0 On sites requiring a confirmation step to update a user's email address, the token used to verify the change should only be accessible via the confirmation email, but was otherwise retrievable by the user. Severity/Risk: Minor Versions affected: 4.5, 4.4 to 4.4.4, 4.3 to 4.3.8, 4.1 to 4.1.14 and earlier unsupported versions Versions fixed: 4.5.1, 4.4.5, 4.3.9 and 4.1.15 Reported by: Vincent Schneider (cli-ish) CVE identifier: CVE-2024-55645 Changes (main): http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-82379 Tracker issue: MDL-82379 Email change confirmation token available via preference _____________________________________________________________________ MSA-24-0054: Database activity issue in separate groups mode, for users not in a group par Michael Hawkins, mardi 17 décembre 2024, 02:54 In a database activity with separate groups mode enabled, users who were not in a group (and did not have permission to access all groups) could see entries from members of all groups in the activity, rather than just entries of users also not in any groups. Note: Users within groups worked as intended, only able to see entries belonging to other members of their group(s). Severity/Risk: Minor Versions affected: 4.5, 4.4 to 4.4.4, 4.3 to 4.3.8, 4.1 to 4.1.14 and earlier unsupported versions Versions fixed: 4.5.1, 4.4.5, 4.3.9 and 4.1.15 Reported by: Jaron Cohen CVE identifier: CVE-2024-55646 Changes (main): http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-82757 Tracker issue: MDL-82757 Database activity issue in separate groups mode, for users not in a group _____________________________________________________________________ MSA-24-0055: Reflected XSS in question bank filter par Michael Hawkins, mardi 17 décembre 2024, 02:54 Question bank filtering required additional sanitizing to prevent a reflected XSS risk. Severity/Risk: Serious Versions affected: 4.5, 4.4 to 4.4.4 and 4.3 to 4.3.8 Versions fixed: 4.5.1, 4.4.5, and 4.3.9 Reported by: Andrey Alekseev (Positive Technologies) CVE identifier: CVE-2024-55647 Changes (main): http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-83357 Tracker issue: MDL-83357 Reflected XSS in question bank filter _____________________________________________________________________ MSA-24-0056: Potential denial of service risk due to guest sessions' longer timeout period par Michael Hawkins, mardi 17 décembre 2024, 02:55 Guest user sessions were given a longer timeout than authenticated users, which could result in an elevated denial of service risk. Severity/Risk: Serious Versions affected: 4.5, 4.4 to 4.4.4, 4.3 to 4.3.8, 4.1 to 4.1.14 and earlier unsupported versions Versions fixed: 4.5.1, 4.4.5, 4.3.9 and 4.1.15 Reported by: Jerome Charaoui CVE identifier: CVE-2024-55648 Changes (main): http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-61316 Tracker issue: MDL-61316 Potential denial of service risk due to guest sessions' longer timeout period ========================================================= + CERT-RENATER | tel : 01-53-94-20-44 + + 23/25 Rue Daviel | fax : 01-53-94-20-41 + + 75013 Paris | email:cert@support.renater.fr + =========================================================