Alert GCSA-24026 - Aggiornamento di sicurezza per Moodle
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ****************************************************************** alert ID: GCSA-24026 data: 22 Febbraio 2024 titolo: Aggiornamento di sicurezza per Moodle ****************************************************************** :: Descrizione del problema Sono state rilasciate nuove versioni della piattaforma di e-learning Moodle con le quali vengono risolte varie vulnerabilita' di sicurezza. MSA-24-0001: Denial of service risk in file picker unzip functionality MSA-24-0002: Forum search accepted random parameters in its URL MSA-24-0003: H5P attempts report did not respect activity group settings MSA-24-0004: Forum export did not respect activity group settings MSA-24-0005: CSRF risk in Language import utility MSA-24-0006: IDOR on dashboard comments block Maggiori informazioni sono disponibili alla sezione "Riferimenti". :: Software interessato Moodle versioni precedenti alla 4.3.3 Moodle versioni precedenti alla 4.2.6 Moodle versioni precedenti alla 4.1.9 (LTS) :: Impatto Denial of Service (DoS) Bypass delle funzionalita' di sicurezza (SFB) Rischio CSRF :: Soluzioni Aggiornare alle versioni piu' recenti Moodle 4.3.3, 4.2.6, 4.1.9 https://moodledev.io/general/releases https://docs.moodle.org/402/en/Upgrading https://download.moodle.org/releases/latest/ :: Riferimenti Moodle - Annunci di sicurezza https://moodle.org/security/ https://moodle.org/mod/forum/view.php?id=7128 https://moodle.org/mod/forum/discuss.php?d=455634 https://moodle.org/mod/forum/discuss.php?d=455635 https://moodle.org/mod/forum/discuss.php?d=455636 https://moodle.org/mod/forum/discuss.php?d=455637 https://moodle.org/mod/forum/discuss.php?d=455638 https://moodle.org/mod/forum/discuss.php?d=455641 Moodle 4.3.3 release notes https://moodledev.io/general/releases/4.3/4.3.3 Moodle 4.2.6 release notes https://moodledev.io/general/releases/4.2/4.2.6 Moodle 4.1.9 release notes https://moodledev.io/general/releases/4.1/4.1.9 Moodle Security https://docs.moodle.org/402/en/Security CSIRT Italia https://www.csirt.gov.it/contenuti/vulnerabilita-in-moodle-al01-240220-csirt-ita Mitre CVE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-25978 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-25979 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-25980 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-25981 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-25982 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-25983 GARR CERT Security Alert - subscribe/unsubscribe: http://www.cert.garr.it/alert/ricevi-gli-alert-di-cert -----BEGIN PGP SIGNATURE----- iF0EAREIAB0WIQTGpdiR5MqstacBGHbBnEyTZRJgQgUCZdcuMAAKCRDBnEyTZRJg QojAAJ9T1jHadxmlZWSTElwAbtKXy9+lYgCgqydoAOIdu15InkGvECBe5HLSW9s= =v6nz -----END PGP SIGNATURE-----