In Moodle, ID numbers displayed in the quiz override screens required additional sanitizing to prevent a stored XSS risk.
In moodle, ID numbers displayed in the web service token list required additional sanitizing to prevent a stored XSS risk.
In Moodle, insufficient capability checks meant message deletions were not limited to the current user.
In Moodle, the file repository's URL parsing required additional recursion handling to mitigate the risk of recursion denial of service.
In Moodle, Users' names required additional sanitizing in the account confirmation email, to prevent a self-registration phishing risk.
In Moodle, in some circumstances, email notifications of messages could have the link back to the original message hidden by HTML, which may pose a phishing risk.
In Moodle, ID numbers exported in HTML data formats required additional sanitizing to prevent a local stored XSS risk.
In Moodle, insufficient capability checks made it possible to remove other users' calendar URL subscriptions.
In Moodle, a remote code execution risk was identified in the Shibboleth authentication plugin.
In Moodle, an SQL injection risk was identified in the library fetching a user's enrolled courses.
In Moodle, an SQL injection risk was identified in the library fetching a user's recent courses.
In Moodle, insufficient redirect handling made it possible to blindly bypass cURL blocked hosts/allowed ports restrictions, resulting in a blind SSRF risk.
Content output by the database auto-linking filter required additional sanitizing to prevent an XSS risk.
In Moodle, insufficient limitations in some quiz web services made it possible for students to bypass sequential navigation during a quiz attempt.
Stronger revision number limitations were required on file serving endpoints to improve cache poisoning protection.
The course upload preview contained an XSS risk for users uploading unsafe data.
In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user who also has direct access to the web server outside of the Moodle webroot could utilise a local file include to achieve remote code execution.
Insufficient web service capability checks made it possible to move categories a user had permission to manage, to a parent category they did not have the capability to manage.
Separate Groups mode restrictions were not honored in the forum summary report, which would display users from other groups. This flaw affects versions 4.2 to 4.2.2, 4.1 to 4.1.5, 4.0 to 4.0.10, 3.11 to 3.11.16, 3.9 to 3.9.23 and earlier unsupported versions.
A remote code execution risk was identified in the Lesson activity. By default this was only available to teachers and managers.
The CSV grade import method contained an XSS risk for users importing the spreadsheet, if it contained unsafe content.
A remote code execution risk was identified in the IMSCP activity. By default this was only available to teachers and managers.
Wiki comments required additional sanitizing and access restrictions to prevent a stored XSS risk and potential IDOR risk.
H5P metadata automatically populated the author with the user's username, which could be sensitive information.
A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions. Insufficient capability checks made it possible to fetch other users' calendar action events.
A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions. The "delete related badge" functionality did not include the necessary token check to prevent a CSRF risk.
A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions. A URL parameter in the filetype site administrator tool required extra sanitizing to prevent a reflected XSS risk.
An authentication bypass risk was identified in the external database authentication functionality, due to a type juggling vulnerability.
Insufficient capability checks made it possible for teachers to download users outside of their courses.
A session hijack risk was identified in the Shibboleth authentication plugin.