Moodle CSRF risks due to misuse of confirm_sesskey

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2024-38276 · ADVISORY
• moodle/moodle commit f2807de · WEB
• moodle/moodle commit e23f603 · WEB
• moodle/moodle commit e1dab5f · WEB
• moodle/moodle commit dc84fcf · WEB
• moodle/moodle commit da8e8ce · WEB
• moodle/moodle commit c5b1604 · WEB
• moodle/moodle commit c1aacb3 · WEB
• moodle/moodle commit c18b598 · WEB
• moodle/moodle commit a0d8c02 · WEB
• moodle/moodle commit 9af9711

moodle/moodle のその他の脆弱性

• CVE-2026-26047中 6.5A denial-of-service vulnerability was identified in Moodle’s TeX formula editor. When rendering TeX content using mimetex, insufficient exec…
• CVE-2026-26045高 7.2A flaw was identified in Moodle’s backup restore functionality where specially crafted backup files were not properly validated during proce…
• CVE-2025-67857中 5.3A flaw was found in moodle. During anonymous assignment submissions, user identifiers were inadvertently exposed in URLs. This data exposure…
• CVE-2025-67856緊急 9.8A flaw was found in Moodle. An authorization logic flaw, specifically due to incomplete role checks during the badge awarding process, allow…
• CVE-2025-67855中 6.1A flaw was found in mooodle. A remote attacker could exploit a reflected Cross-Site Scripting (XSS) vulnerability in the policy tool return …