Authentication endpoints for the mobile client and authwebservice allowed unlimited or insufficiently throttled password attempts. This could enable attackers to systematically guess passwords for known usernames.
Versions affected: 5.0 to 5.0.2, 4.5 to 4.5.6, 4.4 to 4.4.10, 4.1 to 4.1.20 and earlier unsupported versions Versions fixed: 5.0.3, 4.5.7, 4.4.11 and 4.1.21
A missing capability check in the calendar event creation flow allows users with event creation rights to see names of hidden or separate groups. This may expose group names meant to remain private within a course.
Versions affected: 5.0 to 5.0.2, 4.5 to 4.5.6, 4.4 to 4.4.10, 4.1 to 4.1.20 and earlier unsupported versions Versions fixed: 5.0.3, 4.5.7, 4.4.11 and 4.1.21
An issue in Moodle's timed assignment feature allowed students to bypass the time restriction, potentially giving them more time than allowed to complete an assessment.
A flaw in the cohort search web service allowed users with permissions in lower contexts to access cohort information from the system context, revealing restricted administrative data.
Blog search required additional sanitizing to prevent a reflected XSS risk.
Versions affected: 4.1 and 4.0 to 4.0.5 Versions fixed: 4.1.1, 4.0.6
Moodle's non-searchable tags can still be discovered on the tag search page and in the tags block
Description information displayed in the site administration live log required additional sanitizing to prevent a stored XSS risk.
Moodle has a stored XSS in ddimageortext question type
Moodle's feedback response viewing and deletions did not respect Separate Groups mode
Insufficient sanitizing in the TeX notation filter resulted in an arbitrary file read risk on sites where pdfTeX is available (such as those with TeX Live installed).
An SQL injection risk was identified in the module list filter within course search.
Insufficient capability checks made it possible to disable badges a user does not have permission to access.
Additional checks were required to ensure trusttext is applied (when enabled) to glossary entries being restored.
A flaw was found in Feedback. Bulk messaging in the activity's non-respondents report did not verify message recipients belonging to the set of users returned by the report.
A SQL injection risk flaw was found in the XMLDB editor tool available to site administrators.
A flaw was found in pdfTeX. Insufficient sanitizing in the TeX notation filter resulted in an arbitrary file read risk on sites where pdfTeX is available, such as those with TeX Live installed.
A unique key should be generated for a user's QR login key and their auto-login key, so the same key cannot be used interchangeably between the two.
Insufficient capability checks meant it was possible for users to gain access to BigBlueButton join URLs they did not have permission to access.
Insufficient escaping of calendar event titles resulted in a stored XSS risk in the event deletion prompt.
Cross-Site Request Forgery in moodle
Authorization Bypass in moodle
Improper Access Control in moodle
Improper Access Control in moodle
Insufficient file size checks resulted in a denial of service risk in the file picker's unzip functionality.
Improper Handling of Parameters in moodle
In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user who also has direct access to the web server outside of the Moodle webroot could utilise a local file include to achieve remote code execution.
Insufficient web service capability checks made it possible to move categories a user had permission to manage, to a parent category they did not have the capability to manage.
Moodle Exposure of Sensitive Information to an Unauthorized Actor vulnerability
Moodle Cross-site Scripting vulnerability
H5P metadata automatically populated the author with the user's username, which could be sensitive information.