Cette page suit l'état du correctif pour Ubuntu. La vulnérabilité elle-même est décrite sur la page CVE principale. Voir CVE-2026-102588 →

UBUNTU-CVE-2026-102588

A flaw was found in Moodle. The XML grade import feature lacks proper Cross-Site Request Forgery (CSRF) token validation. By tricking an authenticated...

Description d'origine

La description telle que publiée par la source (souvent en anglais).

A flaw was found in Moodle. The XML grade import feature lacks proper Cross-Site Request Forgery (CSRF) token validation. By tricking an authenticated user with grade management permissions into visiting a malicious webpage, an attacker can trigger unauthorized requests on the victim's behalf. This flaw allows a remote attacker to set or overwrite student grades without authorization.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Paquets affectés

Ubuntu:Pro:16.04:LTS moodle

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Ubuntu:Pro:18.04:LTS moodle

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Références

report ubuntu.com
report cve.org
report git.moodle.org
report access.redhat.com
report bugzilla.redhat.com
report moodle.org