Alert GCSA-26217 - Aggiornamento di sicurezza per Moodle

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ****************************************************************** alert ID: GCSA-26217 data: 12 settembre 2026 titolo: Aggiornamento di sicurezza per Moodle ****************************************************************** :: Descrizione del problema Sono state rilasciate nuove versioni della piattaforma di e-learning Moodle con le quali vengono risolte varie vulnerabilita' di sicurezza. MSA-26-0041: CSRF risk in XML grade imports MSA-26-0040: User list filters do not respect user profile field visibility MSA-26-0039: Minor XSS risk via password reset link MSA-26-0038: Enrolling user to course while selecting group does not validate group belongs to that course MSA-26-0037: Missing capability checks allow unauthorised triggering of grade penalty recalculation MSA-26-0036: Incorrect capability check in AI editor placement "generate image" service MSA-26-0035: Manual enrolment does not correctly observe disabled state of plugin MSA-26-0034: XSS risk in forum post templates MSA-26-0033: Arbitrary class instantiation via audience classname in core_reportbuilder MSA-26-0032: User profile information disclosure via grade web service MSA-26-0031: SQL injection risk in question bank web service MSA-26-0030: SSRF risk in URL downloader (bypass some blocked hosts) Maggiori informazioni sono disponibili alla sezione "Riferimenti". :: Software interessato Moodle versioni precedenti alla 5.2.2+ (Current stable) Moodle versioni precedenti alla 5.1.6+ (Current stable) Moodle versioni precedenti alla 5.0.9+ (Current security) Moodle versioni precedenti alla 4.5.13+ (LTS)(Current security) Il produttore specifica che le versioni precedenti alla 4.5.x sono vulnerabili e non beneficiano degli aggiornamenti di sicurezza. :: Impatto Accesso a dati riservati (ID) Bypass delle funzionalita' di sicurezza (SFB) Cross-site Scripting (XSS) SQL Injection (SQLi) Server-side request forgery (SSRF) :: Soluzioni Anche se sono state rilasciate nuove versioni 4.5.x il produttore suggerisce di aggiornare alla serie 5.0 di Moodle. https://docs.moodle.org/500/en/Upgrading https://moodledev.io/general/releases https://download.moodle.org/releases/latest/ https://download.moodle.org/releases/supported/ https://download.moodle.org/releases/security/ :: Riferimenti Moodle - Annunci di sicurezza https://moodle.org/security/ https://moodle.org/mod/forum/discuss.php?d=482495 https://moodle.org/mod/forum/discuss.php?d=482496 https://moodle.org/mod/forum/discuss.php?d=482497 https://moodle.org/mod/forum/discuss.php?d=482498 https://moodle.org/mod/forum/discuss.php?d=482499 https://moodle.org/mod/forum/discuss.php?d=482500 https://moodle.org/mod/forum/discuss.php?d=482501 https://moodle.org/mod/forum/discuss.php?d=482502 https://moodle.org/mod/forum/discuss.php?d=482503 https://moodle.org/mod/forum/discuss.php?d=482504 https://moodle.org/mod/forum/discuss.php?d=482506 https://moodle.org/mod/forum/discuss.php?d=482507 Moodle 5.2.2 release notes https://moodledev.io/general/releases/5.2/5.2.2 Moodle 5.1.6 release notes https://moodledev.io/general/releases/5.1/5.1.6 Moodle 5.0.9 release notes https://moodledev.io/general/releases/5.0/5.0.9 Moodle 4.5.13 release notes https://moodledev.io/general/releases/4.5/4.5.13 Moodle Security best practice https://docs.moodle.org/500/en/Security Riferimenti CVE I riferimenti CVE sono disponibili negli advisory originali. GARR CERT Security Alert - subscribe/unsubscribe: http://www.cert.garr.it/alert/ricevi-gli-alert-di-cert -----BEGIN PGP SIGNATURE----- iF0EAREIAB0WIQTGpdiR5MqstacBGHbBnEyTZRJgQgUCaqVawwAKCRDBnEyTZRJg Qo0XAJ44yRHtK6kNJxQheWxGA2W/NjZyxACgk8m27wPGHurcE0T1rvMmVqJXEoM= =1GDh -----END PGP SIGNATURE-----