All errata/sisyphus/ALT-PU-2025-16854-1
ALT-PU-2025-16854-1

Package update moodle in branch sisyphus

Version5.1.0-alt1
Task#397714
Published2025-10-22
Max severityHIGH
Severity:

Closed issues (18)

BDU:2025-15611
MEDIUM4.3

Уязвимость виртуальной обучающей среды Moodle, связанная с неправильной авторизацией, позволяющая нарушителю обойти существующие ограничения безопасности

Published: 2025-12-11
CVSS 3.xMEDIUM 4.3
CVSS:3.x/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CVSS 2.0MEDIUM 4.0
CVSS:2.0/AV:N/AC:L/Au:S/C:N/I:P/A:N
References
BDU:2025-15612
MEDIUM6.5

Уязвимость виртуальной обучающей среды Moodle, связанная с раскрытием информации, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации

Published: 2025-12-11
CVSS 3.xMEDIUM 6.5
CVSS:3.x/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0MEDIUM 6.8
CVSS:2.0/AV:N/AC:L/Au:S/C:C/I:N/A:N
References
CVE-2025-62393
MEDIUM4.3

A flaw was found in the course overview output function where user access permissions were not fully enforced. This could allow unauthorized users to view information about courses they should not have access to, potentially exposing limited course details.

Published: 2025-10-23Modified: 2025-11-14
CVSS 3.xMEDIUM 4.3
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
References
GHSA-25wf-7x6c-wmpf
MEDIUM5.3

Moodle does not properly enforce MFA

Published: 2025-10-23Modified: 2025-10-24
CVSS 3.xMEDIUM 5.3
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
References
GHSA-422v-w6c5-vq42
MEDIUM4.3

Moodle exposed the names of hidden groups to users

Published: 2025-10-23Modified: 2025-10-24
CVSS 3.xMEDIUM 4.3
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
References
GHSA-8fcv-4qp9-pg32
MEDIUM4.3

Moodle sends quiz-related messages to inactive/suspended users

Published: 2025-10-23Modified: 2025-10-24
CVSS 3.xMEDIUM 4.3
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
References
GHSA-c5cj-xp43-qcc3
MEDIUM5.3

Moodle's error handling leads to sensitive information disclosure

Published: 2025-10-23Modified: 2025-10-24
CVSS 3.xMEDIUM 5.3
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
References
GHSA-m58f-9pvv-8mp2
HIGH7.5

Moodle vulnerable to brute-force password guesses

Published: 2025-10-23Modified: 2025-10-24
CVSS 3.xHIGH 7.5
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
GHSA-rjcm-7v2p-9265
MEDIUM4.3

Moodle course access permissions are not properly checked in course_output_fragment_course_overview

Published: 2025-10-23Modified: 2025-10-24
CVSS 3.xMEDIUM 4.3
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
References
GHSA-w29j-8phw-ffjf
MEDIUM5.4

Moodle has a time restriction bypass

Published: 2025-10-23Modified: 2025-10-24
CVSS 3.xMEDIUM 5.4
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
References