A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions. A remote code execution risk when restoring backup files was identified.
A flaw was found in Moodle in versions 3.11 to 3.11.4. An SQL injection risk was identified in the h5p activity web service responsible for fetching user attempt data.
In Moodle, an SQL injection risk was identified in the library fetching a user's enrolled courses.
In Moodle, an SQL injection risk was identified in the library fetching a user's recent courses.
In Moodle, a remote code execution risk was identified in the Shibboleth authentication plugin.
The Mustache pix helper contained a potential Mustache injection risk if combined with user input (note: This did not appear to be implemented/exploitable anywhere in the core Moodle LMS).
In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user who also has direct access to the web server outside of the Moodle webroot could utilise a local file include to achieve remote code execution.
A flaw was found in Moodle in versions 3.11 to 3.11.4, 3.10 to 3.10.8, 3.9 to 3.9.11 and earlier unsupported versions. The "delete badge alignment" functionality did not include the necessary token check to prevent a CSRF risk.
A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions. The "delete related badge" functionality did not include the necessary token check to prevent a CSRF risk.
An SQL injection risk was identified in Badges code relating to configuring criteria. Access to the relevant capability was limited to teachers and managers by default.
============================================================================== MSA-22-0022: CSRF risk in enabling/disabling installed H5P libraries
Description: Enabling and disabling installed H5P libraries did not include the necessary token to prevent a CSRF risk. Issue summary: CSRF risk in enabling/disabling installed H5P libraries Severity/Risk: Minor Versions affected: 4.0 to 4.0.2 and 3.11 to 3.11.8 Versions fixed: 4.0.3 and 3.11.9 Reported by: Paul Holden Issue no.: MDL-75326 CVE identifier: Pending Changes (master): http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-75326
==============================================================================
A remote code execution risk was identified in the Lesson activity. By default this was only available to teachers and managers.
A remote code execution risk was identified in the IMSCP activity. By default this was only available to teachers and managers.
Insufficient limitations on the "start page" preference made it possible to set that preference for another user. Note that this was still limited to the pre-defined start page options.
Versions affected: 4.1, 4.0 to 4.0.5, 3.11 to 3.11.11, 3.9 to 3.9.18 and earlier unsupported versions Versions fixed: 4.1.1, 4.0.6, 3.11.12 and 3.9.19
In Moodle, the file repository's URL parsing required additional recursion handling to mitigate the risk of recursion denial of service.
In Moodle, insufficient redirect handling made it possible to blindly bypass cURL blocked hosts/allowed ports restrictions, resulting in a blind SSRF risk.
A limited SQL injection risk was identified in functionality used by the Wiki activity when listing pages.
Versions affected: 4.1 to 4.1.2, 4.0 to 4.0.7, 3.11 to 3.11.13, 3.9 to 3.9.20 and earlier unsupported versions Versions fixed: 4.1.3, 4.0.8, 3.11.14 and 3.9.21
An authentication bypass risk was identified in the external database authentication functionality, due to a type juggling vulnerability.
Insufficient sanitizing in backup resulted in an arbitrary file read risk. The capability to access this feature is only available to teachers, managers and admins by default.
Wiki comments required additional sanitizing and access restrictions to prevent a stored XSS risk and potential IDOR risk.
A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions. A URL parameter in the filetype site administrator tool required extra sanitizing to prevent a reflected XSS risk.
MSA-23-0001: Reflected XSS risk in some returnurl parameters
Some returnurl parameters required additional sanitizing to prevent a reflected XSS risk.
Versions affected: 4.1, 4.0 to 4.0.5, 3.11 to 3.11.11, 3.9 to 3.9.18 and earlier unsupported versions Versions fixed: 4.1.1, 4.0.6, 3.11.12 and 3.9.19
If the algebra filter was enabled but not functional (eg the necessary binaries were missing from the server), it presented an XSS risk.
Content output by the database auto-linking filter required additional sanitizing to prevent an XSS risk.
The CSV grade import method contained an XSS risk for users importing the spreadsheet, if it contained unsafe content.
The course upload preview contained an XSS risk for users uploading unsafe data.
A flaw was found in Moodle in versions 3.11 to 3.11.4, 3.10 to 3.10.8, 3.9 to 3.9.11 and earlier unsupported versions. The calendar:manageentries capability allowed managers to access or modify any calendar event, but should have been restricted from accessing user level events.
In certain Moodle products after creating a course, it is possible to add in a arbitrary "Topic" a resource, in this case a "Database" with the type "Text" where its values "Field name" and "Field description" are vulnerable to Cross Site Scripting Stored(XSS). This affects Moodle 3.11 and Moodle 3.10.4 and Moodle 3.9.7.
In Moodle, ID numbers displayed in the quiz override screens required additional sanitizing to prevent a stored XSS risk.
In moodle, ID numbers displayed in the web service token list required additional sanitizing to prevent a stored XSS risk.