mirror of
https://github.com/netbirdio/advisory-database.git
synced 2026-05-22 18:04:22 -07:00
Publish Advisories
GHSA-9c5p-35gj-jqp4 GHSA-fhg2-r2h9-h7q8 GHSA-j822-x5gg-5r56 GHSA-mg54-p2wj-5ph7 GHSA-r4xr-m393-778m GHSA-x3x9-349x-2485 GHSA-xfv7-h2qg-rjm7 GHSA-fhg2-r2h9-h7q8 GHSA-j822-x5gg-5r56 GHSA-r4xr-m393-778m GHSA-xfv7-h2qg-rjm7
This commit is contained in:
advisory-database[bot]
File diff suppressed because one or more lines are too long
@@ -0,0 +1,130 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-fhg2-r2h9-h7q8",
|
||||
"modified": "2024-11-20T18:25:21Z",
|
||||
"published": "2024-11-20T12:30:35Z",
|
||||
"aliases": [
|
||||
"CVE-2024-45690"
|
||||
],
|
||||
"summary": "Moodle IDOR when deleting OAuth2 linked accounts",
|
||||
"details": "A flaw was found in Moodle. Additional checks were required to ensure users can only delete their OAuth2-linked accounts.",
|
||||
"severity": [
|
||||
{
|
||||
"type": "CVSS_V4",
|
||||
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N"
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
{
|
||||
"package": {
|
||||
"ecosystem": "Packagist",
|
||||
"name": "moodle/moodle"
|
||||
},
|
||||
"ranges": [
|
||||
{
|
||||
"type": "ECOSYSTEM",
|
||||
"events": [
|
||||
{
|
||||
"introduced": "0"
|
||||
},
|
||||
{
|
||||
"fixed": "4.1.13"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"package": {
|
||||
"ecosystem": "Packagist",
|
||||
"name": "moodle/moodle"
|
||||
},
|
||||
"ranges": [
|
||||
{
|
||||
"type": "ECOSYSTEM",
|
||||
"events": [
|
||||
{
|
||||
"introduced": "4.2.0-beta"
|
||||
},
|
||||
{
|
||||
"fixed": "4.2.10"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"package": {
|
||||
"ecosystem": "Packagist",
|
||||
"name": "moodle/moodle"
|
||||
},
|
||||
"ranges": [
|
||||
{
|
||||
"type": "ECOSYSTEM",
|
||||
"events": [
|
||||
{
|
||||
"introduced": "4.3.0-beta"
|
||||
},
|
||||
{
|
||||
"fixed": "4.3.7"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"package": {
|
||||
"ecosystem": "Packagist",
|
||||
"name": "moodle/moodle"
|
||||
},
|
||||
"ranges": [
|
||||
{
|
||||
"type": "ECOSYSTEM",
|
||||
"events": [
|
||||
{
|
||||
"introduced": "4.4.0-beta"
|
||||
},
|
||||
{
|
||||
"fixed": "4.4.3"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45690"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/moodle/moodle/commit/809629e5afcd5be087e65668fe6cf67f2f4f5145"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2309939"
|
||||
},
|
||||
{
|
||||
"type": "PACKAGE",
|
||||
"url": "https://github.com/moodle/moodle"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://moodle.org/mod/forum/discuss.php?d=461895#p1854492"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://moodle.org/security"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
"CWE-639"
|
||||
],
|
||||
"severity": "MODERATE",
|
||||
"github_reviewed": true,
|
||||
"github_reviewed_at": "2024-11-20T18:25:21Z",
|
||||
"nvd_published_at": "2024-11-20T11:15:05Z"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,126 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-j822-x5gg-5r56",
|
||||
"modified": "2024-11-20T18:25:16Z",
|
||||
"published": "2024-11-20T12:30:35Z",
|
||||
"aliases": [
|
||||
"CVE-2024-45689"
|
||||
],
|
||||
"summary": "Moodle allows users to retrieve information they did not have permission to access",
|
||||
"details": "A flaw was found in Moodle. Dynamic tables did not enforce capability checks, which resulted in users having the ability to retrieve information they did not have permission to access.",
|
||||
"severity": [
|
||||
{
|
||||
"type": "CVSS_V4",
|
||||
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
{
|
||||
"package": {
|
||||
"ecosystem": "Packagist",
|
||||
"name": "moodle/moodle"
|
||||
},
|
||||
"ranges": [
|
||||
{
|
||||
"type": "ECOSYSTEM",
|
||||
"events": [
|
||||
{
|
||||
"introduced": "0"
|
||||
},
|
||||
{
|
||||
"fixed": "4.1.13"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"package": {
|
||||
"ecosystem": "Packagist",
|
||||
"name": "moodle/moodle"
|
||||
},
|
||||
"ranges": [
|
||||
{
|
||||
"type": "ECOSYSTEM",
|
||||
"events": [
|
||||
{
|
||||
"introduced": "4.2.0-beta"
|
||||
},
|
||||
{
|
||||
"fixed": "4.2.10"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"package": {
|
||||
"ecosystem": "Packagist",
|
||||
"name": "moodle/moodle"
|
||||
},
|
||||
"ranges": [
|
||||
{
|
||||
"type": "ECOSYSTEM",
|
||||
"events": [
|
||||
{
|
||||
"introduced": "4.3.0-beta"
|
||||
},
|
||||
{
|
||||
"fixed": "4.3.7"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"package": {
|
||||
"ecosystem": "Packagist",
|
||||
"name": "moodle/moodle"
|
||||
},
|
||||
"ranges": [
|
||||
{
|
||||
"type": "ECOSYSTEM",
|
||||
"events": [
|
||||
{
|
||||
"introduced": "4.4.0-beta"
|
||||
},
|
||||
{
|
||||
"fixed": "4.4.3"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45689"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/moodle/moodle/commit/bb466df202a4b4a692006298f93cbba20566949c"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2309941"
|
||||
},
|
||||
{
|
||||
"type": "PACKAGE",
|
||||
"url": "https://github.com/moodle/moodle"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://moodle.org/mod/forum/discuss.php?d=461894#p1854491"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
"CWE-285"
|
||||
],
|
||||
"severity": "MODERATE",
|
||||
"github_reviewed": true,
|
||||
"github_reviewed_at": "2024-11-20T18:25:16Z",
|
||||
"nvd_published_at": "2024-11-20T11:15:05Z"
|
||||
}
|
||||
}
|
||||
@@ -1,7 +1,7 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-mg54-p2wj-5ph7",
|
||||
"modified": "2024-11-18T22:37:41Z",
|
||||
"modified": "2024-11-20T18:25:15Z",
|
||||
"published": "2024-11-18T12:30:43Z",
|
||||
"aliases": [
|
||||
"CVE-2024-48901"
|
||||
@@ -108,7 +108,8 @@
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
"CWE-285"
|
||||
"CWE-285",
|
||||
"CWE-863"
|
||||
],
|
||||
"severity": "MODERATE",
|
||||
"github_reviewed": true,
|
||||
|
||||
@@ -0,0 +1,70 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-r4xr-m393-778m",
|
||||
"modified": "2024-11-20T18:25:30Z",
|
||||
"published": "2024-11-20T12:30:35Z",
|
||||
"aliases": [
|
||||
"CVE-2024-48899"
|
||||
],
|
||||
"summary": "Moodle IDOR when accessing list of course badges",
|
||||
"details": "A vulnerability was found in Moodle. Additional checks are required to ensure users can only fetch the list of course badges for courses that they are intended to have access to.",
|
||||
"severity": [
|
||||
{
|
||||
"type": "CVSS_V4",
|
||||
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
{
|
||||
"package": {
|
||||
"ecosystem": "Packagist",
|
||||
"name": "moodle/moodle"
|
||||
},
|
||||
"ranges": [
|
||||
{
|
||||
"type": "ECOSYSTEM",
|
||||
"events": [
|
||||
{
|
||||
"introduced": "4.4.0-beta"
|
||||
},
|
||||
{
|
||||
"fixed": "4.4.3"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-48899"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/moodle/moodle/commit/07ad4b8ebc715056056e01f2175820bfce6b290f"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318819"
|
||||
},
|
||||
{
|
||||
"type": "PACKAGE",
|
||||
"url": "https://github.com/moodle/moodle"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://moodle.org/mod/forum/discuss.php?d=462878#p1858337"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
"CWE-284",
|
||||
"CWE-639"
|
||||
],
|
||||
"severity": "MODERATE",
|
||||
"github_reviewed": true,
|
||||
"github_reviewed_at": "2024-11-20T18:25:30Z",
|
||||
"nvd_published_at": "2024-11-20T11:15:05Z"
|
||||
}
|
||||
}
|
||||
@@ -1,7 +1,7 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-x3x9-349x-2485",
|
||||
"modified": "2024-11-19T20:48:43Z",
|
||||
"modified": "2024-11-20T18:25:07Z",
|
||||
"published": "2024-11-18T12:30:43Z",
|
||||
"aliases": [
|
||||
"CVE-2024-48897"
|
||||
@@ -112,7 +112,8 @@
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
"CWE-285"
|
||||
"CWE-285",
|
||||
"CWE-863"
|
||||
],
|
||||
"severity": "MODERATE",
|
||||
"github_reviewed": true,
|
||||
|
||||
@@ -0,0 +1,131 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-xfv7-h2qg-rjm7",
|
||||
"modified": "2024-11-20T18:25:26Z",
|
||||
"published": "2024-11-20T12:30:35Z",
|
||||
"aliases": [
|
||||
"CVE-2024-45691"
|
||||
],
|
||||
"summary": "Moodle Lesson activity password bypass through PHP loose comparison",
|
||||
"details": "A flaw was found in Moodle. When restricting access to a lesson activity with a password, certain passwords could be bypassed or less secure due to a loose comparison in the password-checking logic. This issue only affected passwords set to \"magic hash\" values.",
|
||||
"severity": [
|
||||
{
|
||||
"type": "CVSS_V4",
|
||||
"score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
{
|
||||
"package": {
|
||||
"ecosystem": "Packagist",
|
||||
"name": "moodle/moodle"
|
||||
},
|
||||
"ranges": [
|
||||
{
|
||||
"type": "ECOSYSTEM",
|
||||
"events": [
|
||||
{
|
||||
"introduced": "0"
|
||||
},
|
||||
{
|
||||
"fixed": "4.1.13"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"package": {
|
||||
"ecosystem": "Packagist",
|
||||
"name": "moodle/moodle"
|
||||
},
|
||||
"ranges": [
|
||||
{
|
||||
"type": "ECOSYSTEM",
|
||||
"events": [
|
||||
{
|
||||
"introduced": "4.2.0-beta"
|
||||
},
|
||||
{
|
||||
"fixed": "4.2.10"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"package": {
|
||||
"ecosystem": "Packagist",
|
||||
"name": "moodle/moodle"
|
||||
},
|
||||
"ranges": [
|
||||
{
|
||||
"type": "ECOSYSTEM",
|
||||
"events": [
|
||||
{
|
||||
"introduced": "4.3.0-beta"
|
||||
},
|
||||
{
|
||||
"fixed": "4.3.7"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"package": {
|
||||
"ecosystem": "Packagist",
|
||||
"name": "moodle/moodle"
|
||||
},
|
||||
"ranges": [
|
||||
{
|
||||
"type": "ECOSYSTEM",
|
||||
"events": [
|
||||
{
|
||||
"introduced": "4.4.0-beta"
|
||||
},
|
||||
{
|
||||
"fixed": "4.4.3"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45691"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/moodle/moodle/commit/3fc1073d304f660d2552b591c5fb92547ed01e92"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2309940"
|
||||
},
|
||||
{
|
||||
"type": "PACKAGE",
|
||||
"url": "https://github.com/moodle/moodle"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://moodle.org/mod/forum/discuss.php?d=461897#p1854494"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://moodle.org/security"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
"CWE-285",
|
||||
"CWE-289"
|
||||
],
|
||||
"severity": "MODERATE",
|
||||
"github_reviewed": true,
|
||||
"github_reviewed_at": "2024-11-20T18:25:26Z",
|
||||
"nvd_published_at": "2024-11-20T11:15:05Z"
|
||||
}
|
||||
}
|
||||
@@ -1,39 +0,0 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-fhg2-r2h9-h7q8",
|
||||
"modified": "2024-11-20T12:30:35Z",
|
||||
"published": "2024-11-20T12:30:35Z",
|
||||
"aliases": [
|
||||
"CVE-2024-45690"
|
||||
],
|
||||
"details": "A flaw was found in Moodle. Additional checks were required to ensure users can only delete their OAuth2-linked accounts.",
|
||||
"severity": [
|
||||
|
||||
],
|
||||
"affected": [
|
||||
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45690"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2309939"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://moodle.org/security"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
|
||||
],
|
||||
"severity": null,
|
||||
"github_reviewed": false,
|
||||
"github_reviewed_at": null,
|
||||
"nvd_published_at": "2024-11-20T11:15:05Z"
|
||||
}
|
||||
}
|
||||
@@ -1,35 +0,0 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-j822-x5gg-5r56",
|
||||
"modified": "2024-11-20T12:30:35Z",
|
||||
"published": "2024-11-20T12:30:35Z",
|
||||
"aliases": [
|
||||
"CVE-2024-45689"
|
||||
],
|
||||
"details": "A flaw was found in Moodle. Dynamic tables did not enforce capability checks, which resulted in users having the ability to retrieve information they did not have permission to access.",
|
||||
"severity": [
|
||||
|
||||
],
|
||||
"affected": [
|
||||
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45689"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2309941"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
|
||||
],
|
||||
"severity": null,
|
||||
"github_reviewed": false,
|
||||
"github_reviewed_at": null,
|
||||
"nvd_published_at": "2024-11-20T11:15:05Z"
|
||||
}
|
||||
}
|
||||
@@ -1,35 +0,0 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-r4xr-m393-778m",
|
||||
"modified": "2024-11-20T12:30:35Z",
|
||||
"published": "2024-11-20T12:30:35Z",
|
||||
"aliases": [
|
||||
"CVE-2024-48899"
|
||||
],
|
||||
"details": "A vulnerability was found in Moodle. Additional checks are required to ensure users can only fetch the list of course badges for courses that they are intended to have access to.",
|
||||
"severity": [
|
||||
|
||||
],
|
||||
"affected": [
|
||||
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-48899"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318819"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
"CWE-284"
|
||||
],
|
||||
"severity": null,
|
||||
"github_reviewed": false,
|
||||
"github_reviewed_at": null,
|
||||
"nvd_published_at": "2024-11-20T11:15:05Z"
|
||||
}
|
||||
}
|
||||
@@ -1,39 +0,0 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-xfv7-h2qg-rjm7",
|
||||
"modified": "2024-11-20T12:30:35Z",
|
||||
"published": "2024-11-20T12:30:35Z",
|
||||
"aliases": [
|
||||
"CVE-2024-45691"
|
||||
],
|
||||
"details": "A flaw was found in Moodle. When restricting access to a lesson activity with a password, certain passwords could be bypassed or less secure due to a loose comparison in the password-checking logic. This issue only affected passwords set to \"magic hash\" values.",
|
||||
"severity": [
|
||||
|
||||
],
|
||||
"affected": [
|
||||
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45691"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2309940"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://moodle.org/security"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
|
||||
],
|
||||
"severity": null,
|
||||
"github_reviewed": false,
|
||||
"github_reviewed_at": null,
|
||||
"nvd_published_at": "2024-11-20T11:15:05Z"
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user