Alert GCSA-26217 - Aggiornamento di sicurezza per Moodle

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

******************************************************************

   alert ID: GCSA-26217
       data: 12 settembre 2026
     titolo: Aggiornamento di sicurezza per Moodle

******************************************************************

:: Descrizione del problema

   Sono state rilasciate nuove versioni della piattaforma di e-learning Moodle
   con le quali vengono risolte varie vulnerabilita' di sicurezza.

   MSA-26-0041: CSRF risk in XML grade imports
   MSA-26-0040: User list filters do not respect user profile field visibility
   MSA-26-0039: Minor XSS risk via password reset link
   MSA-26-0038: Enrolling user to course while selecting group does not validate group belongs to that course
   MSA-26-0037: Missing capability checks allow unauthorised triggering of grade penalty recalculation
   MSA-26-0036: Incorrect capability check in AI editor placement "generate image" service
   MSA-26-0035: Manual enrolment does not correctly observe disabled state of plugin
   MSA-26-0034: XSS risk in forum post templates
   MSA-26-0033: Arbitrary class instantiation via audience classname in core_reportbuilder
   MSA-26-0032: User profile information disclosure via grade web service
   MSA-26-0031: SQL injection risk in question bank web service
   MSA-26-0030: SSRF risk in URL downloader (bypass some blocked hosts)

   Maggiori informazioni sono disponibili alla sezione "Riferimenti".


:: Software interessato

   Moodle versioni precedenti alla 5.2.2+ (Current stable)
   Moodle versioni precedenti alla 5.1.6+ (Current stable)
   Moodle versioni precedenti alla 5.0.9+ (Current security)
   Moodle versioni precedenti alla 4.5.13+ (LTS)(Current security)

   Il produttore specifica che le versioni precedenti alla 4.5.x sono vulnerabili
   e non beneficiano degli aggiornamenti di sicurezza.


:: Impatto

   Accesso a dati riservati (ID)
   Bypass delle funzionalita' di sicurezza (SFB)
   Cross-site Scripting (XSS)
   SQL Injection (SQLi)
   Server-side request forgery (SSRF)


:: Soluzioni

   Anche se sono state rilasciate nuove versioni 4.5.x
   il produttore suggerisce di aggiornare alla serie 5.0 di Moodle.

   https://docs.moodle.org/500/en/Upgrading
   https://moodledev.io/general/releases
   https://download.moodle.org/releases/latest/
   https://download.moodle.org/releases/supported/
   https://download.moodle.org/releases/security/


:: Riferimenti

   Moodle - Annunci di sicurezza
   https://moodle.org/security/
   https://moodle.org/mod/forum/discuss.php?d=482495
   https://moodle.org/mod/forum/discuss.php?d=482496
   https://moodle.org/mod/forum/discuss.php?d=482497
   https://moodle.org/mod/forum/discuss.php?d=482498
   https://moodle.org/mod/forum/discuss.php?d=482499
   https://moodle.org/mod/forum/discuss.php?d=482500
   https://moodle.org/mod/forum/discuss.php?d=482501
   https://moodle.org/mod/forum/discuss.php?d=482502
   https://moodle.org/mod/forum/discuss.php?d=482503
   https://moodle.org/mod/forum/discuss.php?d=482504
   https://moodle.org/mod/forum/discuss.php?d=482506
   https://moodle.org/mod/forum/discuss.php?d=482507

   Moodle 5.2.2 release notes
   https://moodledev.io/general/releases/5.2/5.2.2

   Moodle 5.1.6 release notes
   https://moodledev.io/general/releases/5.1/5.1.6

   Moodle 5.0.9 release notes
   https://moodledev.io/general/releases/5.0/5.0.9

   Moodle 4.5.13 release notes
   https://moodledev.io/general/releases/4.5/4.5.13

   Moodle Security best practice
   https://docs.moodle.org/500/en/Security

   Riferimenti CVE
   I riferimenti CVE sono disponibili negli advisory originali.


GARR CERT Security Alert - subscribe/unsubscribe:
http://www.cert.garr.it/alert/ricevi-gli-alert-di-cert
-----BEGIN PGP SIGNATURE-----

iF0EAREIAB0WIQTGpdiR5MqstacBGHbBnEyTZRJgQgUCaqVawwAKCRDBnEyTZRJg
Qo0XAJ44yRHtK6kNJxQheWxGA2W/NjZyxACgk8m27wPGHurcE0T1rvMmVqJXEoM=
=1GDh
-----END PGP SIGNATURE-----