UBUNTU-CVE-2023-5545

H5P metadata automatically populated the author with the user's username, which could be sensitive information...

CVE-2023-5545

CVE-2023-5545: The vulnerability is an information disclosure where H5P metadata auto-populates the author field with the user’s username, potentially exposing sensitive information. Public sources in OSV and GHSA confirm this leakage across Moodle/H5P contexts. The provided materials do not spec...

CVE-2023-5545 Moodle: auto-populated h5p author name causes a potential information leak

H5P metadata automatically populated the author with the user's username, which could be sensitive information...

CVE-2023-5545 Moodle: auto-populated h5p author name causes a potential information leak

H5P metadata automatically populated the author with the user's username, which could be sensitive information...

CVE-2023-5545 Moodle: auto-populated h5p author name causes a potential information leak

H5P metadata automatically populated the author with the user's username, which could be sensitive information...

PT-2023-32167 · H5P · H5P

Name of the Vulnerable Software and Affected Versions: H5P affected versions not specified Description: The issue concerns H5P metadata automatically populating the author field with the user's username, potentially exposing sensitive information. Recommendations: At the moment, there is no...

Fedora 39 : moodle (2023-6bd1586dc5)

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-6bd1586dc5 advisory. Latest updates Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for...

Moodle < 3.9.24, 3.11.x < 3.11.17, 4.0.x < 4.0.11, 4.1.x < 4.1.6, 4.2.x < 4.2.3 Multiple Vulnerabilities

Moodle is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:moodle:moodle"; ifdescription...

Moodle 4.0.x < 4.0.4 Multiple Vulnerabilities

The version of Moodle installed on the remote host is 3.9.x prior to 3.9.17, 3.11.x prior to 3.11.10 or 4.0.x prior to 4.0.4. It is, therefore, affected by multiple vulnerabilities: - A stored Cross-Site Scripting XSS and page Denial of Service DoS vulnerabilities due to recursive rendering in...

Moodle 3.5.x < 3.5.18 Multiple Vulnerabilities

The version of Moodle installed on the remote host is 3.5.x prior to 3.5.18, 3.8.x prior to 3.8.9, 3.9.x prior to 3.9.7 or 3.10.x prior to 3.10.4. It is, therefore, affected by multiple vulnerabilities: - An authorization issue allowing teachers to export a CSV file containing forums from all...

Moodle 3.9.x < 3.9.16 Multiple Vulnerabilities

The version of Moodle installed on the remote host is 3.9.x prior to 3.9.16, 3.11.x prior to 3.11.9 or 4.0.x prior to 4.0.3. It is, therefore, affected by multiple vulnerabilities: - A vulnerable version of the Mustache template library included in Moodle. CVE-2022-0323 - A Cross-Site Request...

Moodle 3.8.x < 3.8.9 Multiple Vulnerabilities

The version of Moodle installed on the remote host is 3.5.x prior to 3.5.18, 3.8.x prior to 3.8.9, 3.9.x prior to 3.9.7 or 3.10.x prior to 3.10.4. It is, therefore, affected by multiple vulnerabilities: - An authorization issue allowing teachers to export a CSV file containing forums from all...

Moodle 3.9.x < 3.9.17 Multiple Vulnerabilities

The version of Moodle installed on the remote host is 3.9.x prior to 3.9.17, 3.11.x prior to 3.11.10 or 4.0.x prior to 4.0.4. It is, therefore, affected by multiple vulnerabilities: - A stored Cross-Site Scripting XSS and page Denial of Service DoS vulnerabilities due to recursive rendering in...

Moodle 3.9.x < 3.9.12 Multiple Vulnerabilities

The version of Moodle installed on the remote host is 3.9.x prior to 3.9.12, 3.10.x prior to 3.10.9 or 3.11.x prior to 3.11.5. It is, therefore, affected by multiple vulnerabilities: - An SQL injection vulnerability in the h5p activity web service responsible for fetching user attempt data...

Moodle 3.10.x < 3.10.4 Multiple Vulnerabilities

The version of Moodle installed on the remote host is 3.5.x prior to 3.5.18, 3.8.x prior to 3.8.9, 3.9.x prior to 3.9.7 or 3.10.x prior to 3.10.4. It is, therefore, affected by multiple vulnerabilities: - An authorization issue allowing teachers to export a CSV file containing forums from all...

Moodle 3.11.x < 3.11.9 Multiple Vulnerabilities

The version of Moodle installed on the remote host is 3.9.x prior to 3.9.16, 3.11.x prior to 3.11.9 or 4.0.x prior to 4.0.3. It is, therefore, affected by multiple vulnerabilities: - A vulnerable version of the Mustache template library included in Moodle. CVE-2022-0323 - A Cross-Site Request...

Moodle 4.0.x < 4.0.3 Multiple Vulnerabilities

The version of Moodle installed on the remote host is 3.9.x prior to 3.9.16, 3.11.x prior to 3.11.9 or 4.0.x prior to 4.0.3. It is, therefore, affected by multiple vulnerabilities: - A vulnerable version of the Mustache template library included in Moodle. CVE-2022-0323 - A Cross-Site Request...

Moodle 3.9.x < 3.9.7 Multiple Vulnerabilities

The version of Moodle installed on the remote host is 3.5.x prior to 3.5.18, 3.8.x prior to 3.8.9, 3.9.x prior to 3.9.7 or 3.10.x prior to 3.10.4. It is, therefore, affected by multiple vulnerabilities: - An authorization issue allowing teachers to export a CSV file containing forums from all...

Drupal Releases Security Updates to Address Vulnerabilities in H5P and File (Field) Paths

Drupal has released security updates to address vulnerabilities affecting H5P and the File Field Paths modules for Drupal 7.x. An attacker could exploit these vulnerabilities to access sensitive information and remotely execute code. CISA encourages users and administrators to review Drupal’s...

Drupal H5P Module 2.0.0 Zip Slip Traversal Vulnerability

------------------------------------------------------------------ Drupal H5P Module statIndex$i'name'; 892. 893. if pregmatch'/^.|/./', $fileName !== 0 894. continue; // Skip any file or folder starting with a . or 894. This regex check should be enough to prevent path traversal attacks through...