Search

Find a vulnerability

Search criteria

    Related vulnerabilities

    CERTFR-2023-AVI-1050

    Vulnerability from certfr_avis - Published: 2023-12-21 - Updated: 2023-12-21

    De multiples vulnérabilités ont été découvertes dans Moodle. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et une atteinte à la confidentialité des données.

    Solution

    Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

    None
    Impacted products
    Vendor Product Description
    Moodle Moodle Moodle versions antérieures à 3.9.25
    Moodle Moodle Moodle versions 3.11.x antérieures à 3.11.18
    Moodle Moodle Moodle versions 4.0.x antérieures à 4.0.12
    Moodle Moodle Moodle versions 4.1.x antérieures à 4.1.7
    Moodle Moodle Moodle versions 4.2.x antérieures à 4.2.4
    Moodle Moodle Moodle versions 4.3.x antérieures à 4.3.1
    References

    Show details on source website
    To clipboard 

    {
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Moodle versions ant\u00e9rieures \u00e0 3.9.25",
      "product": {
        "name": "Moodle",
        "vendor": {
          "name": "Moodle",
          "scada": false
        }
      }
    },
    {
      "description": "Moodle versions 3.11.x ant\u00e9rieures \u00e0 3.11.18",
      "product": {
        "name": "Moodle",
        "vendor": {
          "name": "Moodle",
          "scada": false
        }
      }
    },
    {
      "description": "Moodle versions 4.0.x ant\u00e9rieures \u00e0 4.0.12",
      "product": {
        "name": "Moodle",
        "vendor": {
          "name": "Moodle",
          "scada": false
        }
      }
    },
    {
      "description": "Moodle versions 4.1.x ant\u00e9rieures \u00e0 4.1.7",
      "product": {
        "name": "Moodle",
        "vendor": {
          "name": "Moodle",
          "scada": false
        }
      }
    },
    {
      "description": "Moodle versions 4.2.x ant\u00e9rieures \u00e0 4.2.4",
      "product": {
        "name": "Moodle",
        "vendor": {
          "name": "Moodle",
          "scada": false
        }
      }
    },
    {
      "description": "Moodle versions 4.3.x ant\u00e9rieures \u00e0 4.3.1",
      "product": {
        "name": "Moodle",
        "vendor": {
          "name": "Moodle",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2023-6662",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-6662"
    },
    {
      "name": "CVE-2023-6667",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-6667"
    },
    {
      "name": "CVE-2023-6661",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-6661"
    },
    {
      "name": "CVE-2023-6663",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-6663"
    },
    {
      "name": "CVE-2023-6665",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-6665"
    },
    {
      "name": "CVE-2023-6670",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-6670"
    },
    {
      "name": "CVE-2023-6666",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-6666"
    },
    {
      "name": "CVE-2023-6664",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-6664"
    },
    {
      "name": "CVE-2023-6669",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-6669"
    },
    {
      "name": "CVE-2023-6668",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-6668"
    }
  ],
  "initial_release_date": "2023-12-21T00:00:00",
  "last_revision_date": "2023-12-21T00:00:00",
  "links": [],
  "reference": "CERTFR-2023-AVI-1050",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2023-12-21T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Injection de code indirecte \u00e0 distance (XSS)"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Moodle. Certaines\nd\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de\ncode arbitraire \u00e0 distance, un d\u00e9ni de service \u00e0 distance et une\natteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans Moodle",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Moodle MSA-23-0053 du 21 d\u00e9cembre 2023",
      "url": "https://moodle.org/mod/forum/discuss.php?d=453767"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Moodle MSA-23-0047 du 21 d\u00e9cembre 2023",
      "url": "https://moodle.org/mod/forum/discuss.php?d=453761"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Moodle MSA-23-0051 du 21 d\u00e9cembre 2023",
      "url": "https://moodle.org/mod/forum/discuss.php?d=453765"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Moodle MSA-23-0049 du 21 d\u00e9cembre 2023",
      "url": "https://moodle.org/mod/forum/discuss.php?d=453763"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Moodle MSA-23-0046 du 21 d\u00e9cembre 2023",
      "url": "https://moodle.org/mod/forum/discuss.php?d=453760"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Moodle MSA-23-0052 du 21 d\u00e9cembre 2023",
      "url": "https://moodle.org/mod/forum/discuss.php?d=453766"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Moodle MSA-23-0048 du 21 d\u00e9cembre 2023",
      "url": "https://moodle.org/mod/forum/discuss.php?d=453762"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Moodle MSA-23-0050 du 21 d\u00e9cembre 2023",
      "url": "https://moodle.org/mod/forum/discuss.php?d=453764"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Moodle MSA-23-0045 du 21 d\u00e9cembre 2023",
      "url": "https://moodle.org/mod/forum/discuss.php?d=453759"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Moodle MSA-23-0044 du 21 d\u00e9cembre 2023",
      "url": "https://moodle.org/mod/forum/discuss.php?d=453758"
    }
  ]
}

    GSD-2023-6670

    Vulnerability from gsd - Updated: 2023-12-13 01:20
    Details
    ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.
    Aliases
    Aliases
    CVE-2023-6670
    To clipboard 

    {
  "GSD": {
    "alias": "CVE-2023-6670",
    "id": "GSD-2023-6670"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2023-6670"
      ],
      "id": "GSD-2023-6670",
      "modified": "2023-12-13T01:20:33.022426Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "cve@mitre.org",
        "ID": "CVE-2023-6670",
        "STATE": "RESERVED"
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
          }
        ]
      }
    }
  }
}

    WID-SEC-W-2023-3026

    Vulnerability from csaf_certbund - Published: 2023-11-28 23:00 - Updated: 2023-11-28 23:00
    Summary
    Trellix Enterprise Security Manager: Mehrere Schwachstellen
    Severity
    Hoch
    Scope
    2 vulnerabilities in this advisory, including CVE-2023-6670.
    CVE-2023-6670

    Es existiert eine Schwachstelle in Trellix Enterprise Security Manager. Diese ist auf eine Server-Side-Request-Forgery-Anfälligkeit zurückzuführen. Ein entfernter, authentisierter Angreifer kann diese Schwachstelle ausnutzen, um Dateien zu manipulieren.

    Open the full advisory

    WID-SEC-W-2023-3199

    Vulnerability from csaf_certbund - Published: 2023-12-20 23:00 - Updated: 2023-12-20 23:00
    Summary
    Moodle: Mehrere Schwachstellen
    Severity
    Hoch
    Scope
    10 vulnerabilities in this advisory, including CVE-2023-6670.
    CVE-2023-6670

    In Moodle existieren mehrere Schwachstellen. Die Schwachstellen betreffen unter anderem die Komponenten logstore, URL Downloader, course blocks, mtrace, admin ad-hoc tasks page und grader report aufgrund von unzureichenden Eingabeüberprüfungen, unzureichenden Berechtigungsprüfungen, unzureichenden Rekursionsbeschränkungen und XSS-Problemen. Ein authentifizierter Angreifer kann diese Schwachstellen ausnutzen, um einen Cross-Site-Scripting-Angriff durchzuführen, Code auszuführen, einen Denial-of-Service-Angriff zu starten, Informationen offen zu legen und Sicherheitsvorkehrungen zu umgehen. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion, um erfolgreich ausgenutzt zu werden.

    Open the full advisory