{"id":3315,"date":"2023-05-05T14:28:34","date_gmt":"2023-05-05T19:28:34","guid":{"rendered":"https:\/\/cert.pa\/?p=3315"},"modified":"2023-05-05T14:29:00","modified_gmt":"2023-05-05T19:29:00","slug":"csirt-panama-aviso-2023-05-05-moodle-multiples-vulnerabilidades-en-moodle","status":"publish","type":"post","link":"https:\/\/cert.pa\/?p=3315","title":{"rendered":"CSIRT Panam\u00e1 Aviso 2023-05-05 Moodle: M\u00faltiples vulnerabilidades en Moodle"},"content":{"rendered":"\n<p><\/p>\n\n\n\n<p>Gravedad: Alta\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/p>\n\n\n\n<p>Fecha de publicaci\u00f3n: mayo 5, 2023<br>\u00daltima revisi\u00f3n: mayo 5, 2023<\/p>\n\n\n\n<p>Sitio web: <a href=\"https:\/\/moodle.org\">https:\/\/moodle.org<\/a><\/p>\n\n\n\n<p>Sistemas Afectados:<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>desde 4.1 hasta 4.1.2;<\/li><li>desde 4.0 hasta 4.0.7;<\/li><li>desde 3.11 hasta 3.11.13;<\/li><li>desde 3.9 hasta 3.9.20;<\/li><li>versiones anteriores sin soporte.<\/li><\/ul>\n\n\n\n<p>I. <strong>Descripci\u00f3n<\/strong><\/p>\n\n\n\n<p>Los investigadores, Yaniv Nizry y Paul Holden, han reportado 2 vulnerabilidades, una de severidad alta y otra baja, que afectan a Moodle<\/p>\n\n\n\n<p>II. <strong>Impacto<\/strong><\/p>\n\n\n\n<p>Vulnerabilidad: CVE-2023-30943<\/p>\n\n\n\n<p>Un saneamiento insuficiente de los cargadores utilizados por TinyMCE (editor de texto WYSIWYG para HTML) podr\u00eda permitir la generaci\u00f3n arbitraria de carpetas en el sistema.<\/p>\n\n\n\n<p>La vulnerabilidad de severidad baja tiene asignado el identificador CVE-2023-30944.<\/p>\n\n\n\n<p><strong>III. Referencia a soluciones, herramientas e informaci\u00f3n<\/strong><strong><\/strong><\/p>\n\n\n\n<p>Actualizar a la versi\u00f3n de Moodle, 4.1.3, 4.0.8, 3.11.14 y 3.9.21, mediante el siguiente enlace: &nbsp;https:\/\/download.moodle.org\/<\/p>\n\n\n\n<p><strong>Fuentes:<\/strong><\/p>\n\n\n\n<ol class=\"wp-block-list\" type=\"1\"><li>Instituto Nacional de Ciberseguridad, INCIBE. Avisos Seguridad, Vulnerabilidad cr\u00edtica en Drupal. 2 de mayo del 2023. Recopilado en: https:\/\/www.incibe.es\/incibe-cert\/alerta-temprana\/avisos\/multiples-vulnerabilidades-en-moodle<\/li><\/ol>\n\n\n\n<p><strong>Informaci\u00f3n de contacto<\/strong><br>CSIRT PANAMA<br>Computer Security Incident Response Team Autoridad Nacional para la Innovacion Gubernamental<br>E-Mail: info@cert.pa<br>Phone: +507 520-CERT (2378)<br>Web: https:\/\/cert.pa<br>Twitter: @CSIRTPanama<br>Key ID: 16F2B124<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Gravedad: Alta\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Fecha de publicaci\u00f3n: mayo 5, 2023\u00daltima revisi\u00f3n: mayo 5, 2023 Sitio web: https:\/\/moodle.org Sistemas Afectados: desde 4.1 hasta 4.1.2;desde 4.0 hasta 4.0.7;desde 3.11 hasta 3.11.13;desde 3.9 hasta 3.9.20;versiones anteriores sin soporte. I. Descripci\u00f3n&#8230;<\/p>\n","protected":false},"author":4,"featured_media":3316,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"_uf_show_specific_survey":0,"_uf_disable_surveys":false,"footnotes":""},"categories":[4],"tags":[8,72,128,68],"class_list":["post-3315","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-avisos-de-seguridad","tag-avisos","tag-avisos-de-seguridad","tag-moodle","tag-vulnerabilidades"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/cert.pa\/index.php?rest_route=\/wp\/v2\/posts\/3315","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cert.pa\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cert.pa\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cert.pa\/index.php?rest_route=\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/cert.pa\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=3315"}],"version-history":[{"count":4,"href":"https:\/\/cert.pa\/index.php?rest_route=\/wp\/v2\/posts\/3315\/revisions"}],"predecessor-version":[{"id":3320,"href":"https:\/\/cert.pa\/index.php?rest_route=\/wp\/v2\/posts\/3315\/revisions\/3320"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cert.pa\/index.php?rest_route=\/wp\/v2\/media\/3316"}],"wp:attachment":[{"href":"https:\/\/cert.pa\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=3315"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cert.pa\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=3315"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cert.pa\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=3315"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}