Bug 2507979

Summary: CVE-2026-58342 moodle: CSRF risk when adding quiz section headings [fedora-all]
Product: [Fedora] Fedora Reporter: Dhananjay Arunesh <darunesh>
Component: moodleAssignee: Gwyn Ciesla <gwync>
Status: CLOSED CURRENTRELEASE QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: medium Docs Contact:
Priority: medium    
Version: rawhideCC: gwync, igor.raits
Target Milestone: ---Keywords: Security, SecurityTracking
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard: {"flaws": ["3d647af0-da4f-4f81-9bbe-f2b4744530f8"]}
Fixed In Version: Doc Type: ---
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2026-07-28 18:21:48 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 2494829    

Description Dhananjay Arunesh 2026-07-28 11:22:16 UTC 
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

MSA-26-0023: CSRF risk when adding quiz section headings

Description:       The quiz feature to add section headings did not include
the necessary token to prevent a CSRF risk.
Issue summary:     CSRF risk when adding quiz section headings
Severity/Risk:     Minor
Versions affected: 5.2, 5.1 to 5.1.4, 5.0 to 5.0.7, 4.5 to 4.5.11 and earlier
unsupported versions
Versions fixed:    5.2.1, 5.1.5, 5.0.8 and 4.5.12
Reported by:       Paul Holden
Issue no.:         MDL-88540