In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user who also has direct access to the web server outside of the Moodle webroot could utilise a local file include to achieve remote code execution.

Insufficient web service capability checks made it possible to move categories a user had permission to manage, to a parent category they did not have the capability to manage.

Moodle Exposure of Sensitive Information to an Unauthorized Actor vulnerability

Moodle Cross-site Scripting vulnerability

H5P metadata automatically populated the author with the user's username, which could be sensitive information.

Moodle Acceptance of Extraneous Untrusted Data With Trusted Data vulnerability

Moodle Cross-site Scripting vulnerability

A remote code execution risk was identified in the Lesson activity. By default this was only available to teachers and managers.

Moodle Cross-site Scripting vulnerability

A remote code execution risk was identified in the IMSCP activity. By default this was only available to teachers and managers.

Content on the groups page required additional sanitizing to prevent an XSS risk. This flaw affects Moodle versions 4.2, 4.1 to 4.1.3, 4.0 to 4.0.8 and 3.11 to 3.11.14.

A limited SQL injection risk was identified on the Mnet SSO access control page. This flaw affects Moodle versions 4.2, 4.1 to 4.1.3, 4.0 to 4.0.8, 3.11 to 3.11.14, 3.9 to 3.9.21 and earlier unsupported versions.

An issue in the logic used to check 0.0.0.0 against the cURL blocked hosts lists resulted in an SSRF risk. This flaw affects Moodle versions 4.2, 4.1 to 4.1.3, 4.0 to 4.0.8, 3.11 to 3.11.14, 3.9 to 3.9.21 and earlier unsupported versions.

A limited SQL injection risk was identified in functionality used by the Wiki activity when listing pages.

Versions affected: 4.1 to 4.1.2, 4.0 to 4.0.7, 3.11 to 3.11.13, 3.9 to 3.9.20 and earlier unsupported versions Versions fixed: 4.1.3, 4.0.8, 3.11.14 and 3.9.21

Insufficient filtering of grade report history made it possible for teachers to access the names of users they could not otherwise access.

Insufficient sanitizing in backup resulted in an arbitrary file read risk. The capability to access this feature is only available to teachers, managers and admins by default.

If the algebra filter was enabled but not functional (eg the necessary binaries were missing from the server), it presented an XSS risk.

Insufficient validation of profile field availability condition resulted in an SQL injection risk (by default only available to teachers and managers).

Moodle's Mustache pix helper contained a potential Mustache injection risk if combined with user input

Content output by the database auto-linking filter required additional sanitizing to prevent an XSS risk.

Moodle Cross-site Scripting vulnerability

Insufficient limitations on the "start page" preference made it possible to set that preference for another user. Note that this was still limited to the pre-defined start page options.

Versions affected: 4.1, 4.0 to 4.0.5, 3.11 to 3.11.11, 3.9 to 3.9.18 and earlier unsupported versions Versions fixed: 4.1.1, 4.0.6, 3.11.12 and 3.9.19

Moodle may display roles to users who don't have access to them

A blind Server-Side Request Forgery (SSRF) vulnerability was found in Moodle. This flaw exists due to insufficient validation of user-supplied input in LTI provider library. The library does not utilise Moodle's inbuilt cURL helper, which resulted in a blind SSRF risk. An attacker can send a specially crafted HTTP request and trick the application to initiate requests to arbitrary systems. This vulnerability allows a remote attacker to perform SSRF attacks.

A vulnerability was found in Moodle which exists due to insufficient validation of the HTTP request origin in course redirect URL. A user's CSRF token was unnecessarily included in the URL when being redirected to a course they have just restored. A remote attacker can trick the victim to visit a specially crafted web page and perform arbitrary actions on behalf of the victim on the vulnerable website. This flaw allows an attacker to perform cross-site request forgery attacks.

A reflected cross-site scripting vulnerability was discovered in Moodle. This flaw exists due to insufficient sanitization of user-supplied data in policy tool. An attacker can trick the victim to open a specially crafted link that executes an arbitrary HTML and script code in user's browser in context of vulnerable website. This vulnerability may allow an attacker to perform cross-site scripting (XSS) attacks to gain access potentially sensitive information and modification of web pages.

Moodle stored-XSS vulnerability in some "social" user profile fields

Moodle No groups filtering in H5P activity attempts report

A limited SQL injection risk was identified in the "browse list of users" site administration page.

Moodle Stored Cross-site Scripting and page denial of service