An SQL injection risk was identified in the module list filter within course search.
MSA-24-0005: CSRF risk in Language import utility
Description: The link to update all installed language packs did not include the necessary token to prevent a CSRF risk. Issue summary: CSRF risk in Language import utility Severity/Risk: Minor Versions affected: 4.3 to 4.3.2, 4.2 to 4.2.5, 4.1 to 4.1.8 and earlier unsupported versions Versions fixed: 4.3.3, 4.2.6 and 4.1.9 Reported by: Panagiotis Petasis Issue no.: MDL-54749 CVE identifier: Pending Changes (master): http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-54749
Insufficient validation of profile field availability condition resulted in an SQL injection risk (by default only available to teachers and managers).
Insufficient sanitizing in the TeX notation filter resulted in an arbitrary file read risk on sites where pdfTeX is available (such as those with TeX Live installed).
Description information displayed in the site administration live log required additional sanitizing to prevent a stored XSS risk.
Insufficient file size checks resulted in a denial of service risk in the file picker's unzip functionality.
An issue in the logic used to check 0.0.0.0 against the cURL blocked hosts lists resulted in an SSRF risk. This flaw affects Moodle versions 4.2, 4.1 to 4.1.3, 4.0 to 4.0.8, 3.11 to 3.11.14, 3.9 to 3.9.21 and earlier unsupported versions.
Separate Groups mode restrictions were not factored into permission checks before allowing viewing or deletion of responses in Feedback activities.
A limited SQL injection risk was identified on the Mnet SSO access control page. This flaw affects Moodle versions 4.2, 4.1 to 4.1.3, 4.0 to 4.0.8, 3.11 to 3.11.14, 3.9 to 3.9.21 and earlier unsupported versions.
The drag-and-drop onto image (ddimageortext) question type required additional sanitizing to prevent a stored XSS risk.
Content on the groups page required additional sanitizing to prevent an XSS risk. This flaw affects Moodle versions 4.2, 4.1 to 4.1.3, 4.0 to 4.0.8 and 3.11 to 3.11.14.
MSA-24-0003: H5P attempts report did not respect activity group settings
Description: Separate Groups mode restrictions were not honoured in the H5P attempts report, which would display users from other groups. By default this only provided additional access to non-editing teachers. Issue summary: H5P attempts report did not respect activity group settings Severity/Risk: Minor Versions affected: 4.3 to 4.3.2, 4.2 to 4.2.5, 4.1 to 4.1.8 and earlier unsupported versions Versions fixed: 4.3.3, 4.2.6 and 4.1.9 Reported by: Leon Stringer Issue no.: MDL-80501 CVE identifier: Pending Changes (master): http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-80501
MSA-24-0002: Forum search accepted random parameters in its URL
Description: The URL parameters accepted by forum search were not limited to the allowed parameters. Issue summary: Forum search accepted random parameters in its URL Severity/Risk: Minor Versions affected: 4.3 to 4.3.2, 4.2 to 4.2.5, 4.1 to 4.1.8 and earlier unsupported versions Versions fixed: 4.3.3, 4.2.6 and 4.1.9 Reported by: Piotr Widak Issue no.: MDL-69774 CVE identifier: Pending Changes (master): http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-69774
Insufficient checks in a web service made it possible to add comments to the comments block on another user's dashboard when it was not otherwise available (e.g., on their profile page).
MSA-24-0004: Forum export did not respect activity group settings
Description: Separate Groups mode restrictions were not honoured when performing a forum export, which would export forum data for all groups. By default this only provided additional access to non-editing teachers. Issue summary: Forum export did not respect activity group settings Severity/Risk: Minor Versions affected: 4.3 to 4.3.2, 4.2 to 4.2.5, 4.1 to 4.1.8 and earlier unsupported versions Versions fixed: 4.3.3, 4.2.6 and 4.1.9 Reported by: Leon Stringer Issue no.: MDL-80504 CVE identifier: Pending Changes (master): http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-80504
Tags not expected to be visible to a user could still be discovered by them via the tag search page or in the tags block.
Insufficient capability checks made it possible to disable badges a user does not have permission to access.
Additional checks were required to ensure trusttext is applied (when enabled) to glossary entries being restored.
The course participation report required additional checks to prevent roles being displayed which the user did not have access to view.
Insufficient filtering of grade report history made it possible for teachers to access the names of users they could not otherwise access.