Security-Blog

Following 7 security issues have been resolved:

0046342: Membership: Potential unauthenticated access by anonymous
0047936: Learning Progress: Unauthenticated access to general course information
0048220: Learning Sequence: Missing RBAC check in learning sequence
0048241: User Service: Remove SYSTEM_ROLE from List of Assignable Roles in Local User Administration
0048260: Group: Missing permission checks in groups
0048264: SCORM 1.2: Missing authorisation in ilObjSAHSLearningModuleGUI for uploads in SCORM
0048265: File: Unauthorized Upload of Files

Following 6 security issues have been resolved:

0046342: Membership: Potential unauthenticated access by anonymous
0047936: Learning Progress: Unauthenticated access to general course information
0048220: Learning Sequence: Missing RBAC check in learning sequence
0048260: Group: Missing permission checks in groups
0048264: SCORM 1.2: Missing authorisation in ilObjSAHSLearningModuleGUI for uploads in SCORM
0048265: File: Unauthorized Upload of Files

Following 6 security issues have been resolved:

0046342: Membership: Potential unauthenticated access by anonymous
0047936: Learning Progress: Unauthenticated access to general course information
0048009: SOAP: Authenticated arbitrary file read
0048260: Group: Missing permission checks in groups
0048264: SCORM 1.2: Missing authorisation in ilObjSAHSLearningModuleGUI for uploads in SCORM
0048265: File: Unauthorized Upload of Files

Following 10 security issues have been resolved:

0047893: Course: Add missing permission checks for Learning Objectives-Driven Courses
0048009: SOAP Authenticated arbitrary file read
0048026: Course: Unauthorized access to settings
0048067: Authenticated RCE via MediaPool
0048123: COPage: Full Path Disclosure
0048128: SQL injection in Repository Trash
0048152: Unauthenticated PHP object injection -> RCE in the Shibboleth logout endpoint
0048153: Filesystem: Enforce extraction limits in Unzip
0048156: LTI: Unauthorized access to settings
0048158: Object title removed from permission message.

Following 10 security issues have been resolved:

0047893: Course: Add missing permission checks for Learning Objectives-Driven Courses
0048009: SOAP Authenticated arbitrary file read
0048026: Course: Unauthorized access to settings
0048067: Authenticated RCE via MediaPool
0048123: COPage: Full Path Disclosure
0048128: SQL injection in Repository Trash
0048152: Unauthenticated PHP object injection -> RCE in the Shibboleth logout endpoint
0048153: Filesystem: Enforce extraction limits in Unzip
0048156: LTI: Unauthorized access to settings
0048158: Object title removed from permission message.