{"id":3672,"date":"2023-12-26T11:34:28","date_gmt":"2023-12-26T16:34:28","guid":{"rendered":"https:\/\/cert.pa\/?p=3672"},"modified":"2023-12-26T11:34:30","modified_gmt":"2023-12-26T16:34:30","slug":"csirt-panama-aviso-2023-12-26-moodle-multiples-vulnerabilidades-en-moodle","status":"publish","type":"post","link":"https:\/\/cert.pa\/?p=3672","title":{"rendered":"CSIRT Panam\u00e1 Aviso 2023-12-26 Moodle: M\u00faltiples vulnerabilidades en Moodle"},"content":{"rendered":"\n<p>CSIRT Panam\u00e1 Aviso 2023-12-26 Moodle: M\u00faltiples vulnerabilidades en Moodle<\/p>\n\n\n\n<p>Gravedad: Alta&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/p>\n\n\n\n<p>Fecha de publicaci\u00f3n: diciembre 26, 2023<br>\u00daltima revisi\u00f3n: diciembre 26, 2023<\/p>\n\n\n\n<p>Sitio web: https:\/\/moodle.org\/<\/p>\n\n\n\n<p>Sistemas Afectados:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>4.3;<\/li>\n\n\n\n<li>desde 4.2 hasta 4.2.3;<\/li>\n\n\n\n<li>desde 4.1 hasta 4.1.6;<\/li>\n\n\n\n<li>desde 4.0 hasta 4.0.11;<\/li>\n\n\n\n<li>desde 3.11 hasta 3.11.17;<\/li>\n\n\n\n<li>desde 3.9 hasta 3.9.24;<\/li>\n\n\n\n<li>versiones anteriores sin soporte.<\/li>\n\n\n\n<li><strong>Descripci\u00f3n<\/strong><\/li>\n<\/ul>\n\n\n\n<p>Varios investigadores han reportado 4 vulnerabilidades de severidad cr\u00edtica y varias bajas que se pueden consultar en la web de avisos de Moodle.<\/p>\n\n\n\n<ol class=\"wp-block-list\" type=\"I\">\n<li><strong>Impacto<\/strong><\/li>\n<\/ol>\n\n\n\n<p>Vulnerabilidad: CVE-2023-6661<\/p>\n\n\n\n<p>Se ha identificado un riesgo de ejecuci\u00f3n remota de c\u00f3digo (RCE) en logstore. Por defecto, s\u00f3lo est\u00e1 disponible para los administradores.<\/p>\n\n\n\n<p>Vulnerabilidad: CVE-2023-6662<\/p>\n\n\n\n<p>Unas limitaciones de recursividad insuficientes podr\u00edan provocar una condici\u00f3n de denegaci\u00f3n de servicio (DoS) en el descargador de URL.<\/p>\n\n\n\n<p>Vulnerabilidad: CVE-2023-6663<\/p>\n\n\n\n<p>Los bloques de curso con vulnerables a una ejecuci\u00f3n remota de c\u00f3digo. Por defecto, s\u00f3lo est\u00e1 disponible para profesores y gestores.<\/p>\n\n\n\n<p>Vulnerabilidad: CVE-2023-6670<\/p>\n\n\n\n<p>El par\u00e1metro classname de la p\u00e1gina de tareas ad-hoc del administrador requiere una sanitizaci\u00f3n adicional para evitar una vulnerabilidad de Cross-Site Scripting (XSS) reflejado.<\/p>\n\n\n\n<p><strong>III. Referencia a soluciones, herramientas e informaci\u00f3n<\/strong><strong><\/strong><\/p>\n\n\n\n<p>Actualizar a la versi\u00f3n de Moodle, respectivamente: 4.3.1, 4.2.4, 4.1.7, 4.0.12, 3.11.18 y 3.9.25. a trav\u00e9s del sitio: https:\/\/download.moodle.org\/<\/p>\n\n\n\n<p><strong>Fuentes:<\/strong><\/p>\n\n\n\n<ol class=\"wp-block-list\" type=\"1\">\n<li>Instituto Nacional de Ciberseguridad, INCIBE. Avisos Seguridad. M\u00faltiples vulnerabilidades en Moodle. Recopilado en: https:\/\/www.incibe.es\/incibe-cert\/alerta-temprana\/avisos\/multiples-vulnerabilidades-en-moodle-3<\/li>\n<\/ol>\n\n\n\n<p><strong>Informaci\u00f3n de contacto<\/strong><br>CSIRT PANAMA<br>Computer Security Incident Response Team Autoridad Nacional para la Innovacion Gubernamental<br>E-Mail: info@cert.pa<br>Phone: +507 520-CERT (2378)<br>Web: https:\/\/cert.pa<br>Twitter: @CSIRTPanama<br>Key ID: 16F2B124<\/p>\n","protected":false},"excerpt":{"rendered":"<p>CSIRT Panam\u00e1 Aviso 2023-12-26 Moodle: M\u00faltiples vulnerabilidades en Moodle Gravedad: Alta&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Fecha de publicaci\u00f3n: diciembre 26, 2023\u00daltima revisi\u00f3n: diciembre 26, 2023 Sitio web: https:\/\/moodle.org\/ Sistemas Afectados: 4.3; desde 4.2 hasta 4.2.3; desde 4.1 hasta 4.1.6;&#8230;<\/p>\n","protected":false},"author":4,"featured_media":2299,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"_uf_show_specific_survey":0,"_uf_disable_surveys":false,"footnotes":""},"categories":[4],"tags":[],"class_list":["post-3672","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-avisos-de-seguridad"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/cert.pa\/index.php?rest_route=\/wp\/v2\/posts\/3672","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cert.pa\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cert.pa\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cert.pa\/index.php?rest_route=\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/cert.pa\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=3672"}],"version-history":[{"count":1,"href":"https:\/\/cert.pa\/index.php?rest_route=\/wp\/v2\/posts\/3672\/revisions"}],"predecessor-version":[{"id":3673,"href":"https:\/\/cert.pa\/index.php?rest_route=\/wp\/v2\/posts\/3672\/revisions\/3673"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cert.pa\/index.php?rest_route=\/wp\/v2\/media\/2299"}],"wp:attachment":[{"href":"https:\/\/cert.pa\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=3672"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cert.pa\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=3672"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cert.pa\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=3672"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}