Skip to content

Commit d4834d8

Browse files
mickhawkinsmickhawkins
committed
[docs] Add security announcements to 4.4.2 and friends
1 parent c7a0b23 commit d4834d8

File tree

4 files changed

+67
-8
lines changed

4 files changed

+67
-8
lines changed

‎general/releases/4.1/4.1.12.md‎

Lines changed: 16 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -32,5 +32,19 @@ import { ReleaseNoteIntro } from '@site/src/components/ReleaseInformation';
3232
<!-- cspell:enable -->
3333

3434
## Security fixes
35-
36-
A number of security related issues were resolved. Details of these issues will be released after a period of approximately one week to allow system administrators to safely update to the latest version.
35+
<!-- cspell:disable -->
36+
- [MSA-24-0026](https://moodle.org/mod/forum/discuss.php?d=461193) - Remote code execution via calculated question types
37+
- [MSA-24-0027](https://moodle.org/mod/forum/discuss.php?d=461194) - Arbitrary file read risk through pdfTeX
38+
- [MSA-24-0028](https://moodle.org/mod/forum/discuss.php?d=461195) - Admin presets export tool includes some secrets that should not be exported
39+
- [MSA-24-0029](https://moodle.org/mod/forum/discuss.php?d=461196) - Cache poisoning via injection into storage
40+
- [MSA-24-0030](https://moodle.org/mod/forum/discuss.php?d=461197) - User information visibility control issues in gradebook reports
41+
- [MSA-24-0032](https://moodle.org/mod/forum/discuss.php?d=461199) - IDOR in badges allows deletion of arbitrary badges
42+
- [MSA-24-0033](https://moodle.org/mod/forum/discuss.php?d=461200) - Authorization headers preserved between "emulated redirects"
43+
- [MSA-24-0035](https://moodle.org/mod/forum/discuss.php?d=461203) - CSRF risk in Feedback non-respondents report
44+
- [MSA-24-0036](https://moodle.org/mod/forum/discuss.php?d=461205) - Can create global glossary without being admin
45+
- [MSA-24-0037](https://moodle.org/mod/forum/discuss.php?d=461206) - Site administration SQL injection via XMLDB editor
46+
- [MSA-24-0038](https://moodle.org/mod/forum/discuss.php?d=461207) - XSS risk when restoring malicious course backup file
47+
- [MSA-24-0039](https://moodle.org/mod/forum/discuss.php?d=461208) - IDOR in Feedback non-respondents report allows messaging arbitrary site users
48+
- [MSA-24-0040](https://moodle.org/mod/forum/discuss.php?d=461209) - Reflected XSS via H5P error message
49+
- [MSA-24-0041](https://moodle.org/mod/forum/discuss.php?d=461210) - LFI vulnerability when restoring malformed block backups
50+
<!-- cspell:enable -->

‎general/releases/4.2/4.2.9.md‎

Lines changed: 16 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -30,5 +30,19 @@ import { ReleaseNoteIntro } from '@site/src/components/ReleaseInformation';
3030
<!-- cspell:enable -->
3131

3232
## Security fixes
33-
34-
A number of security related issues were resolved. Details of these issues will be released after a period of approximately one week to allow system administrators to safely update to the latest version.
33+
<!-- cspell:disable -->
34+
- [MSA-24-0026](https://moodle.org/mod/forum/discuss.php?d=461193) - Remote code execution via calculated question types
35+
- [MSA-24-0027](https://moodle.org/mod/forum/discuss.php?d=461194) - Arbitrary file read risk through pdfTeX
36+
- [MSA-24-0028](https://moodle.org/mod/forum/discuss.php?d=461195) - Admin presets export tool includes some secrets that should not be exported
37+
- [MSA-24-0029](https://moodle.org/mod/forum/discuss.php?d=461196) - Cache poisoning via injection into storage
38+
- [MSA-24-0030](https://moodle.org/mod/forum/discuss.php?d=461197) - User information visibility control issues in gradebook reports
39+
- [MSA-24-0032](https://moodle.org/mod/forum/discuss.php?d=461199) - IDOR in badges allows deletion of arbitrary badges
40+
- [MSA-24-0033](https://moodle.org/mod/forum/discuss.php?d=461200) - Authorization headers preserved between "emulated redirects"
41+
- [MSA-24-0035](https://moodle.org/mod/forum/discuss.php?d=461203) - CSRF risk in Feedback non-respondents report
42+
- [MSA-24-0036](https://moodle.org/mod/forum/discuss.php?d=461205) - Can create global glossary without being admin
43+
- [MSA-24-0037](https://moodle.org/mod/forum/discuss.php?d=461206) - Site administration SQL injection via XMLDB editor
44+
- [MSA-24-0038](https://moodle.org/mod/forum/discuss.php?d=461207) - XSS risk when restoring malicious course backup file
45+
- [MSA-24-0039](https://moodle.org/mod/forum/discuss.php?d=461208) - IDOR in Feedback non-respondents report allows messaging arbitrary site users
46+
- [MSA-24-0040](https://moodle.org/mod/forum/discuss.php?d=461209) - Reflected XSS via H5P error message
47+
- [MSA-24-0041](https://moodle.org/mod/forum/discuss.php?d=461210) - LFI vulnerability when restoring malformed block backups
48+
<!-- cspell:enable -->

‎general/releases/4.3/4.3.6.md‎

Lines changed: 17 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -95,5 +95,20 @@ import { ReleaseNoteIntro } from '@site/src/components/ReleaseInformation';
9595
<!-- cspell:enable -->
9696

9797
## Security fixes
98-
99-
A number of security related issues were resolved. Details of these issues will be released after a period of approximately one week to allow system administrators to safely update to the latest version.
98+
<!-- cspell:disable -->
99+
- [MSA-24-0026](https://moodle.org/mod/forum/discuss.php?d=461193) - Remote code execution via calculated question types
100+
- [MSA-24-0027](https://moodle.org/mod/forum/discuss.php?d=461194) - Arbitrary file read risk through pdfTeX
101+
- [MSA-24-0028](https://moodle.org/mod/forum/discuss.php?d=461195) - Admin presets export tool includes some secrets that should not be exported
102+
- [MSA-24-0029](https://moodle.org/mod/forum/discuss.php?d=461196) - Cache poisoning via injection into storage
103+
- [MSA-24-0030](https://moodle.org/mod/forum/discuss.php?d=461197) - User information visibility control issues in gradebook reports
104+
- [MSA-24-0032](https://moodle.org/mod/forum/discuss.php?d=461199) - IDOR in badges allows deletion of arbitrary badges
105+
- [MSA-24-0033](https://moodle.org/mod/forum/discuss.php?d=461200) - Authorization headers preserved between "emulated redirects"
106+
- [MSA-24-0034](https://moodle.org/mod/forum/discuss.php?d=461202) - Matrix user/power level management not always working as expected with suspended users
107+
- [MSA-24-0035](https://moodle.org/mod/forum/discuss.php?d=461203) - CSRF risk in Feedback non-respondents report
108+
- [MSA-24-0036](https://moodle.org/mod/forum/discuss.php?d=461205) - Can create global glossary without being admin
109+
- [MSA-24-0037](https://moodle.org/mod/forum/discuss.php?d=461206) - Site administration SQL injection via XMLDB editor
110+
- [MSA-24-0038](https://moodle.org/mod/forum/discuss.php?d=461207) - XSS risk when restoring malicious course backup file
111+
- [MSA-24-0039](https://moodle.org/mod/forum/discuss.php?d=461208) - IDOR in Feedback non-respondents report allows messaging arbitrary site users
112+
- [MSA-24-0040](https://moodle.org/mod/forum/discuss.php?d=461209) - Reflected XSS via H5P error message
113+
- [MSA-24-0041](https://moodle.org/mod/forum/discuss.php?d=461210) - LFI vulnerability when restoring malformed block backups
114+
<!-- cspell:enable -->

‎general/releases/4.4/4.4.2.md‎

Lines changed: 18 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -104,5 +104,21 @@ import { ReleaseNoteIntro } from '@site/src/components/ReleaseInformation';
104104
<!-- cspell:enable -->
105105

106106
## Security fixes
107-
108-
A number of security related issues were resolved. Details of these issues will be released after a period of approximately one week to allow system administrators to safely update to the latest version.
107+
<!-- cspell:disable -->
108+
- [MSA-24-0026](https://moodle.org/mod/forum/discuss.php?d=461193) - Remote code execution via calculated question types
109+
- [MSA-24-0027](https://moodle.org/mod/forum/discuss.php?d=461194) - Arbitrary file read risk through pdfTeX
110+
- [MSA-24-0028](https://moodle.org/mod/forum/discuss.php?d=461195) - Admin presets export tool includes some secrets that should not be exported
111+
- [MSA-24-0029](https://moodle.org/mod/forum/discuss.php?d=461196) - Cache poisoning via injection into storage
112+
- [MSA-24-0030](https://moodle.org/mod/forum/discuss.php?d=461197) - User information visibility control issues in gradebook reports
113+
- [MSA-24-0031](https://moodle.org/mod/forum/discuss.php?d=461198) - Lack of access control when using external methods for Quiz overrides
114+
- [MSA-24-0032](https://moodle.org/mod/forum/discuss.php?d=461199) - IDOR in badges allows deletion of arbitrary badges
115+
- [MSA-24-0033](https://moodle.org/mod/forum/discuss.php?d=461200) - Authorization headers preserved between "emulated redirects"
116+
- [MSA-24-0034](https://moodle.org/mod/forum/discuss.php?d=461202) - Matrix user/power level management not always working as expected with suspended users
117+
- [MSA-24-0035](https://moodle.org/mod/forum/discuss.php?d=461203) - CSRF risk in Feedback non-respondents report
118+
- [MSA-24-0036](https://moodle.org/mod/forum/discuss.php?d=461205) - Can create global glossary without being admin
119+
- [MSA-24-0037](https://moodle.org/mod/forum/discuss.php?d=461206) - Site administration SQL injection via XMLDB editor
120+
- [MSA-24-0038](https://moodle.org/mod/forum/discuss.php?d=461207) - XSS risk when restoring malicious course backup file
121+
- [MSA-24-0039](https://moodle.org/mod/forum/discuss.php?d=461208) - IDOR in Feedback non-respondents report allows messaging arbitrary site users
122+
- [MSA-24-0040](https://moodle.org/mod/forum/discuss.php?d=461209) - Reflected XSS via H5P error message
123+
- [MSA-24-0041](https://moodle.org/mod/forum/discuss.php?d=461210) - LFI vulnerability when restoring malformed block backups
124+
<!-- cspell:enable -->

0 commit comments

Comments
 (0)