PT-2023-25157 · Moodle+2 · Moodle+2

Paul Holden · Published 2020-11-08 · Updated 2024-04-19 · CVE-2023-35132

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Moodle versions 3.9 to 3.9.21 Moodle versions 3.11 to 3.11.14 Moodle versions 4.0 to 4.0.8 Moodle versions 4.1 to 4.1.3 Moodle version 4.2

Description A limited SQL injection risk was identified on the Mnet SSO access control page. This flaw is related to insufficient cleaning of user-provided data, which can be exploited by a remote attacker to read, delete, or modify data in the database and gain full control over the vulnerable application.

Recommendations For Moodle versions 3.9 to 3.9.21, update to a version that includes the fix for this issue. For Moodle versions 3.11 to 3.11.14, update to a version that includes the fix for this issue. For Moodle versions 4.0 to 4.0.8, update to a version that includes the fix for this issue. For Moodle versions 4.1 to 4.1.3, update to a version that includes the fix for this issue. For Moodle version 4.2, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to the Mnet SSO access control page until a patch is available.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

ALT-PU-2020-3235

ALT-PU-2020-3289

ALT-PU-2023-2012

ALT-PU-2023-2057

ALT-PU-2023-5127

BIT-MOODLE-2023-35132

CVE-2023-35132

GHSA-49MV-VFCP-8GG9

Affected Products

Alt Linux

Moodle

Red Os

References · 17

• https://lists.fedoraproject.org/archives/list/[e-mail]/message/7A72KX4WU6GK2CX4TKYFGFASPKOEOJFC · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-35132 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-35132 · Security Note
• https://osv.dev/vulnerability/GHSA-49mv-vfcp-8gg9 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7A72KX4WU6GK2CX4TKYFGFASPKOEOJFC · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-35132 · Vendor Advisory
• https://moodle.org/mod/forum/discuss.php?d=447830 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I5QAEAGJ44NVXLAJFJXKARKC45OGEDXT · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-35132 · Security Note
• https://osv.dev/vulnerability/CVE-2023-35132 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/I5QAEAGJ44NVXLAJFJXKARKC45OGEDXT · Vendor Advisory
• https://osv.dev/vulnerability/BIT-moodle-2023-35132 · Vendor Advisory
• https://github.com/moodle/moodle · Note
• http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-77193 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=2214371 · Note