All errata/sisyphus/ALT-PU-2020-3235-2
ALT-PU-2020-3235-2

Package update moodle in branch sisyphus

Version3.10.0-alt1
Task#261207
Published2026-02-04
Max severityCRITICAL
Severity:

Closed issues (103)

BDU:2022-04906
HIGH7.2

Уязвимость виртуальной обучающей среды moodle, существующая из-за непринятия мер по защите структуры веб-страницы, позволяющая нарушителю выполнить произвольный код и раскрыть защищаемую информацию

Published: 2022-08-10Modified: 2022-10-21
CVSS 3.xHIGH 7.2
CVSS:3.x/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
CVSS 2.0MEDIUM 6.4
CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:N
References
BDU:2022-04907
MEDIUM4.7

Уязвимость реализации функции автоматического входа в систему с мобильных устройств виртуальной обучающей среды Moodle, позволяющая нарушителю провести фишинговую атаку и раскрыть защищаемую информацию

Published: 2022-08-10Modified: 2022-10-21
CVSS 3.xMEDIUM 4.7
CVSS:3.x/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N
CVSS 2.0MEDIUM 5.0
CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N
References
BDU:2022-04908
MEDIUM6.1

Уязвимость модуля LTI виртуальной обучающей среды Moodle, позволяющая нарушителю проводить фишинговые атаки или раскрыть защищаемую информацию

Published: 2022-08-10Modified: 2022-10-21
CVSS 3.xMEDIUM 6.1
CVSS:3.x/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS 2.0MEDIUM 6.4
CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:N
References
BDU:2022-06359
CRITICAL9.8

Уязвимость виртуальной обучающей среды Moodle, связанная с недостаточной очисткой пользовательских данных, позволяющая нарушителю выполнить произвольные SQL-команды

Published: 2022-10-20
CVSS 3.xCRITICAL 9.8
CVSS:3.x/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0CRITICAL 10.0
CVSS:2.0/AV:N/AC:L/Au:N/C:C/I:C/A:C
References
BDU:2022-06382
MEDIUM4.3

Уязвимость плагина H5P виртуальной обучающей среды Moodle, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации

Published: 2022-10-21
CVSS 3.xMEDIUM 4.3
CVSS:3.x/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS 2.0MEDIUM 5.0
CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N
References
BDU:2022-06383
CRITICAL9.8

Уязвимость виртуальной обучающей среды Moodle, связанная с восстановлением в памяти недостоверных данных, позволяющая нарушителю выполнить произвольный код

Published: 2022-10-21
CVSS 3.xCRITICAL 9.8
CVSS:3.x/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0CRITICAL 10.0
CVSS:2.0/AV:N/AC:L/Au:N/C:C/I:C/A:C
References
BDU:2022-06402
HIGH7.1

Уязвимость реализации функции рекурсивного рендеринга компонента Mustache helpers системы шаблонов Mustache template system виртуальной обучающей среды Moodle, позволяющая нарушителю проводить межсайтовые сценарные атаки или вызвать отказ в обслуживании

Published: 2022-10-21
CVSS 3.xHIGH 7.1
CVSS:3.x/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
CVSS 2.0HIGH 7.5
CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P
References
BDU:2022-06403
CRITICAL9.8

Уязвимость виртуальной обучающей среды Moodle, связанная с неправильной проверкой входных данных, позволяющая нарушителю выполнить произвольный код

Published: 2022-10-21
CVSS 3.xCRITICAL 9.8
CVSS:3.x/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0CRITICAL 10.0
CVSS:2.0/AV:N/AC:L/Au:N/C:C/I:C/A:C
References
BDU:2022-06405
HIGH7.5

Уязвимость виртуальной обучающей среды Moodle, связанная с недостаточной проверкой входных данных, позволяющая нарушителю раскрыть защищаемую информацию

Published: 2022-10-21Modified: 2026-04-17
CVSS 3.xHIGH 7.5
CVSS:3.x/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0HIGH 7.8
CVSS:2.0/AV:N/AC:L/Au:N/C:C/I:N/A:N
References
BDU:2022-07405
MEDIUM5.4

Уязвимость системы управления курсами Moodle, связанная с недостаточной проверкой источника HTTP-запроса в URL-адресе перенаправления курса, позволяющая нарушителю выполнять атаки с подделкой межсайтовых запросов

Published: 2022-12-24Modified: 2022-12-27
CVSS 3.xMEDIUM 5.4
CVSS:3.x/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
CVSS 2.0MEDIUM 6.4
CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:N
References
BDU:2022-07406
MEDIUM5.4

Уязвимость системы управления курсами Moodle, существующая из-за непринятия мер по защите структуры веб-страницы, позволяющая нарушителю выполнять атаки с использованием межсайтовых сценариев (XSS)

Published: 2022-12-24Modified: 2022-12-27
CVSS 3.xMEDIUM 5.4
CVSS:3.x/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
CVSS 2.0MEDIUM 6.4
CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:N
References
BDU:2022-07408
CRITICAL9.1

Уязвимость системы управления курсами Moodle, связанная с недостаточной проверкой введенных пользователем данных в библиотеке поставщика LTI, позволяющая нарушителю выполнять SSRF-атаки

Published: 2022-12-24Modified: 2022-12-27
CVSS 3.xCRITICAL 9.1
CVSS:3.x/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS 2.0CRITICAL 9.4
CVSS:2.0/AV:N/AC:L/Au:N/C:C/I:C/A:N
References
BDU:2023-03462
HIGH8.2

Уязвимость виртуальной обучающей среды Moodle, связанная с неправильным контролем доступа, позволяющая нарушителю получить несанкционированный доступ к ограниченным функциям

Published: 2023-06-28Modified: 2023-07-24
CVSS 3.xHIGH 8.2
CVSS:3.x/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
CVSS 2.0CRITICAL 9.7
CVSS:2.0/AV:N/AC:L/Au:N/C:C/I:P/A:C
References
BDU:2023-03478
MEDIUM6.1

Уязвимость виртуальной обучающей среды Moodle, существующая из-за непринятия мер по защите структуры веб-страницы, позволяющая нарушителю провести атаку межсайтового скриптинга (XSS)

Published: 2023-06-30Modified: 2023-07-24
CVSS 3.xMEDIUM 6.1
CVSS:3.x/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS 2.0MEDIUM 6.4
CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:N
References
BDU:2023-03480
HIGH7.3

Уязвимость виртуальной обучающей среды Moodle, связанная с недостаточной очисткой данных, позволяющая нарушителю выполнять произвольные SQL-запросы в базе данных

Published: 2023-06-30Modified: 2023-07-24
CVSS 3.xHIGH 7.3
CVSS:3.x/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS 2.0HIGH 7.5
CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P
References
BDU:2023-07958
CRITICAL9.8

Уязвимость виртуальной обучающей среды Moodle, связанная с неверным управлением генерацией кода, позволяющая нарушителю выполнить произвольный код

Published: 2023-11-18Modified: 2024-04-04
CVSS 3.xCRITICAL 9.8
CVSS:3.x/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0CRITICAL 10.0
CVSS:2.0/AV:N/AC:L/Au:N/C:C/I:C/A:C
References
BDU:2023-07959
HIGH8.8

Уязвимость виртуальной обучающей среды Moodle, связанная с неверным управлением генерацией кода, позволяющая нарушителю выполнить произвольный код

Published: 2023-11-18
CVSS 3.xHIGH 8.8
CVSS:3.x/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0CRITICAL 9.0
CVSS:2.0/AV:N/AC:L/Au:S/C:C/I:C/A:C
References
BDU:2024-02590
MEDIUM5.4

Уязвимость виртуальной обучающей среды Moodle, связанная с неправильной нейтрализацией ввода во время создания веб-страницы, позволяющая нарушителю осуществлять межсайтовые сценарные атаки (XSS)

Published: 2024-04-04
CVSS 3.xMEDIUM 5.4
CVSS:3.x/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVSS 2.0MEDIUM 5.5
CVSS:2.0/AV:N/AC:L/Au:S/C:P/I:P/A:N
References
BDU:2024-02591
MEDIUM6.1

Уязвимость виртуальной обучающей среды Moodle, связанная с неправильной нейтрализацией ввода во время создания веб-страницы, позволяющая нарушителю осуществлять межсайтовые сценарные атаки (XSS)

Published: 2024-04-04
CVSS 3.xMEDIUM 6.1
CVSS:3.x/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS 2.0MEDIUM 6.4
CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:N
References
BDU:2024-02592
LOW3.3

Уязвимость виртуальной обучающей среды Moodle, связанная с раскрытием конфиденциальной информации несанкционированному субъекту, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации

Published: 2024-04-04
CVSS 3.xLOW 3.3
CVSS:3.x/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS 2.0LOW 1.7
CVSS:2.0/AV:L/AC:L/Au:S/C:P/I:N/A:N
References
BDU:2024-05803
MEDIUM6.1

Уязвимость виртуальной обучающей среды Moodle, существующая из-за непринятия мер по защите структуры веб-страницы, позволяющая нарушителю провести атаку межсайтового скриптинга (XSS)

Published: 2024-07-29
CVSS 3.xMEDIUM 6.1
CVSS:3.x/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS 2.0MEDIUM 6.4
CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:N
References
CVE-2020-25698
HIGH7.5

Users' enrollment capabilities were not being sufficiently checked in Moodle when they are restored into an existing course. This could lead to them unenrolling users without having permission to do so. Versions affected: 3.5 to 3.5.14, 3.7 to 3.7.8, 3.8 to 3.8.5, 3.9 to 3.9.2 and earlier unsupported versions. Fixed in 3.9.3, 3.8.6, 3.7.9, 3.5.15, and 3.10.

Published: 2020-11-19Modified: 2024-11-21
CVSS 2.0MEDIUM 5.0
CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:P/A:N
CVSS 3.xHIGH 7.5
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
References
CVE-2020-25699
HIGH7.5

In moodle, insufficient capability checks could lead to users with the ability to course restore adding additional capabilities to roles within that course. Versions affected: 3.9 to 3.9.2, 3.8 to 3.8.5, 3.7 to 3.7.8, 3.5 to 3.5.14 and earlier unsupported versions. This is fixed in moodle 3.9.3, 3.8.6, 3.7.9, 3.5.15, and 3.10.

Published: 2020-11-19Modified: 2024-11-21
CVSS 2.0MEDIUM 5.0
CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:P/A:N
CVSS 3.xHIGH 7.5
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
References
CVE-2020-25700
MEDIUM6.5

In moodle, some database module web services allowed students to add entries within groups they did not belong to. Versions affected: 3.9 to 3.9.2, 3.8 to 3.8.5, 3.7 to 3.7.8, 3.5 to 3.5.14 and earlier unsupported versions. This is fixed in moodle 3.8.6, 3.7.9, 3.5.15, and 3.10.

Published: 2020-11-19Modified: 2024-11-21
CVSS 2.0MEDIUM 4.0
CVSS:2.0/AV:N/AC:L/Au:S/C:N/I:P/A:N
CVSS 3.xMEDIUM 6.5
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
References
CVE-2020-25701
MEDIUM5.3

If the upload course tool in Moodle was used to delete an enrollment method which did not exist or was not already enabled, the tool would erroneously enable that enrollment method. This could lead to unintended users gaining access to the course. Versions affected: 3.9 to 3.9.2, 3.8 to 3.8.5, 3.7 to 3.7.8, 3.5 to 3.5.14 and earlier unsupported versions. This is fixed in moodle 3.9.3, 3.8.6, 3.7.9, 3.5.15, and 3.10.

Published: 2020-11-19Modified: 2024-11-21
CVSS 2.0MEDIUM 5.0
CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:P/A:N
CVSS 3.xMEDIUM 5.3
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
References
CVE-2020-25702
MEDIUM6.1

In Moodle, it was possible to include JavaScript when re-naming content bank items. Versions affected: 3.9 to 3.9.2. This is fixed in moodle 3.9.3 and 3.10.

Published: 2020-11-19Modified: 2024-11-21
CVSS 2.0MEDIUM 4.3
CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:P/A:N
CVSS 3.xMEDIUM 6.1
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
References
CVE-2020-25703
MEDIUM5.3

The participants table download in Moodle always included user emails, but should have only done so when users' emails are not hidden. Versions affected: 3.9 to 3.9.2, 3.8 to 3.8.5 and 3.7 to 3.7.8. This is fixed in moodle 3.9.3, 3.8.6, 3.7.9, and 3.10.

Published: 2020-11-19Modified: 2024-11-21
CVSS 2.0MEDIUM 5.0
CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N
CVSS 3.xMEDIUM 5.3
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
References
CVE-2022-35649
CRITICAL9.8

The vulnerability was found in Moodle, occurs due to improper input validation when parsing PostScript code. An omitted execution parameter results in a remote code execution risk for sites running GhostScript versions older than 9.50. Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Published: 2022-07-25Modified: 2024-11-21
CVSS 3.xCRITICAL 9.8
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
CVE-2022-35650
HIGH7.5

The vulnerability was found in Moodle, occurs due to input validation error when importing lesson questions. This insufficient path checks results in arbitrary file read risk. This vulnerability allows a remote attacker to perform directory traversal attacks. The capability to access this feature is only available to teachers, managers and admins by default.

Published: 2022-07-25Modified: 2024-11-21
CVSS 3.xHIGH 7.5
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
References
CVE-2022-35651
MEDIUM6.1

A stored XSS and blind SSRF vulnerability was found in Moodle, occurs due to insufficient sanitization of user-supplied data in the SCORM track details. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website to steal potentially sensitive information, change appearance of the web page, can perform phishing and drive-by-download attacks.

Published: 2022-07-25Modified: 2024-11-21
CVSS 3.xMEDIUM 6.1
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
References
CVE-2022-35652
MEDIUM6.1

An open redirect issue was found in Moodle due to improper sanitization of user-supplied data in mobile auto-login feature. A remote attacker can create a link that leads to a trusted website, however, when clicked, it redirects the victims to arbitrary URL/domain. Successful exploitation of this vulnerability may allow a remote attacker to perform a phishing attack and steal potentially sensitive information.

Published: 2022-07-25Modified: 2024-11-21
CVSS 3.xMEDIUM 6.1
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
References
CVE-2022-35653
MEDIUM6.1

A reflected XSS issue was identified in the LTI module of Moodle. The vulnerability exists due to insufficient sanitization of user-supplied data in the LTI module. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website to steal potentially sensitive information, change appearance of the web page, can perform phishing and drive-by-download attacks. This vulnerability does not impact authenticated users.

Published: 2022-07-25Modified: 2024-11-21
CVSS 3.xMEDIUM 6.1
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
References
CVE-2022-40316
MEDIUM4.3

The H5P activity attempts report did not filter by groups, which in separate groups mode could reveal information to non-editing teachers about attempts/users in groups they should not have access to.

Published: 2022-09-30Modified: 2025-05-20
CVSS 3.xMEDIUM 4.3
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
References
CVE-2022-45149
MEDIUM5.4

A vulnerability was found in Moodle which exists due to insufficient validation of the HTTP request origin in course redirect URL. A user's CSRF token was unnecessarily included in the URL when being redirected to a course they have just restored. A remote attacker can trick the victim to visit a specially crafted web page and perform arbitrary actions on behalf of the victim on the vulnerable website. This flaw allows an attacker to perform cross-site request forgery attacks.

Published: 2022-11-23Modified: 2025-04-25
CVSS 3.xMEDIUM 5.4
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
References
CVE-2022-45150
MEDIUM6.1

A reflected cross-site scripting vulnerability was discovered in Moodle. This flaw exists due to insufficient sanitization of user-supplied data in policy tool. An attacker can trick the victim to open a specially crafted link that executes an arbitrary HTML and script code in user's browser in context of vulnerable website. This vulnerability may allow an attacker to perform cross-site scripting (XSS) attacks to gain access potentially sensitive information and modification of web pages.

Published: 2022-11-23Modified: 2025-04-25
CVSS 3.xMEDIUM 6.1
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
References
CVE-2022-45152
CRITICAL9.1

A blind Server-Side Request Forgery (SSRF) vulnerability was found in Moodle. This flaw exists due to insufficient validation of user-supplied input in LTI provider library. The library does not utilise Moodle's inbuilt cURL helper, which resulted in a blind SSRF risk. An attacker can send a specially crafted HTTP request and trick the application to initiate requests to arbitrary systems. This vulnerability allows a remote attacker to perform SSRF attacks.

Published: 2022-11-25Modified: 2025-04-29
CVSS 3.xCRITICAL 9.1
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
References
CVE-2023-1402
MEDIUM4.3

The course participation report required additional checks to prevent roles being displayed which the user did not have access to view.

Published: 2023-03-23Modified: 2024-11-21
CVSS 3.xMEDIUM 4.3
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
References
CVE-2023-23921
MEDIUM6.1

The vulnerability was found Moodle which exists due to insufficient sanitization of user-supplied data in some returnurl parameters. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website. This flaw allows a remote attacker to perform cross-site scripting (XSS) attacks.

Published: 2023-02-17Modified: 2024-11-21
CVSS 3.xMEDIUM 6.1
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
References
CVE-2023-23923
HIGH8.2

The vulnerability was found Moodle which exists due to insufficient limitations on the "start page" preference. A remote attacker can set that preference for another user. The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.

Published: 2023-02-17Modified: 2024-11-21
CVSS 3.xHIGH 8.2
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
References
CVE-2023-28329
HIGH8.8

Insufficient validation of profile field availability condition resulted in an SQL injection risk (by default only available to teachers and managers).

Published: 2023-03-23Modified: 2024-11-21
CVSS 3.xHIGH 8.8
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
CVE-2023-28330
MEDIUM6.5

Insufficient sanitizing in backup resulted in an arbitrary file read risk. The capability to access this feature is only available to teachers, managers and admins by default.

Published: 2023-03-23Modified: 2024-11-21
CVSS 3.xMEDIUM 6.5
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
References
CVE-2023-28331
MEDIUM6.1

Content output by the database auto-linking filter required additional sanitizing to prevent an XSS risk.

Published: 2023-03-23Modified: 2025-02-25
CVSS 3.xMEDIUM 6.1
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
References
CVE-2023-28332
MEDIUM6.1

If the algebra filter was enabled but not functional (eg the necessary binaries were missing from the server), it presented an XSS risk.

Published: 2023-03-23Modified: 2024-11-21
CVSS 3.xMEDIUM 6.1
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
References
CVE-2023-28333
CRITICAL9.8

The Mustache pix helper contained a potential Mustache injection risk if combined with user input (note: This did not appear to be implemented/exploitable anywhere in the core Moodle LMS).

Published: 2023-03-23Modified: 2024-11-21
CVSS 3.xCRITICAL 9.8
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
CVE-2023-28336
MEDIUM4.3

Insufficient filtering of grade report history made it possible for teachers to access the names of users they could not otherwise access.

Published: 2023-03-23Modified: 2024-11-21
CVSS 3.xMEDIUM 4.3
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
References
CVE-2023-30944
HIGH7.3

The vulnerability was found Moodle which exists due to insufficient sanitization of user-supplied data in external Wiki method for listing pages. A remote attacker can send a specially crafted request to the affected application and execute limited SQL commands within the application database.

Published: 2023-05-02Modified: 2024-11-21
CVSS 3.xHIGH 7.3
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
References
CVE-2023-35132
MEDIUM6.3

A limited SQL injection risk was identified on the Mnet SSO access control page. This flaw affects Moodle versions 4.2, 4.1 to 4.1.3, 4.0 to 4.0.8, 3.11 to 3.11.14, 3.9 to 3.9.21 and earlier unsupported versions.

Published: 2023-06-22Modified: 2024-11-21
CVSS 3.xMEDIUM 6.3
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
References
CVE-2023-35133
HIGH7.5

An issue in the logic used to check 0.0.0.0 against the cURL blocked hosts lists resulted in an SSRF risk. This flaw affects Moodle versions 4.2, 4.1 to 4.1.3, 4.0 to 4.0.8, 3.11 to 3.11.14, 3.9 to 3.9.21 and earlier unsupported versions.

Published: 2023-06-22Modified: 2024-11-21
CVSS 3.xHIGH 7.5
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
References
CVE-2023-5539
HIGH8.8

A remote code execution risk was identified in the Lesson activity. By default this was only available to teachers and managers.

Published: 2023-11-09Modified: 2024-11-21
CVSS 3.xHIGH 8.8
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
CVE-2023-5540
HIGH8.8

A remote code execution risk was identified in the IMSCP activity. By default this was only available to teachers and managers.

Published: 2023-11-09Modified: 2024-11-21
CVSS 3.xHIGH 8.8
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
CVE-2023-5541
MEDIUM6.1

The CSV grade import method contained an XSS risk for users importing the spreadsheet, if it contained unsafe content.

Published: 2023-11-09Modified: 2024-11-21
CVSS 3.xMEDIUM 6.1
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
References
CVE-2023-5544
MEDIUM5.4

Wiki comments required additional sanitizing and access restrictions to prevent a stored XSS risk and potential IDOR risk.

Published: 2023-11-09Modified: 2024-11-21
CVSS 3.xMEDIUM 5.4
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
References
CVE-2023-5545
MEDIUM5.3

H5P metadata automatically populated the author with the user's username, which could be sensitive information.

Published: 2023-11-09Modified: 2024-11-21
CVSS 3.xMEDIUM 5.3
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
References
CVE-2023-5547
MEDIUM6.1

The course upload preview contained an XSS risk for users uploading unsafe data.

Published: 2023-11-09Modified: 2024-11-21
CVSS 3.xMEDIUM 6.1
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
References
CVE-2023-5548
MEDIUM5.3

Stronger revision number limitations were required on file serving endpoints to improve cache poisoning protection.

Published: 2023-11-09Modified: 2024-11-21
CVSS 3.xMEDIUM 5.3
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
References
CVE-2023-5549
MEDIUM5.3

Insufficient web service capability checks made it possible to move categories a user had permission to manage, to a parent category they did not have the capability to manage.

Published: 2023-11-09Modified: 2024-11-21
CVSS 3.xMEDIUM 5.3
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
References
CVE-2023-5550
CRITICAL9.8

In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user who also has direct access to the web server outside of the Moodle webroot could utilise a local file include to achieve remote code execution.

Published: 2023-11-09Modified: 2024-11-21
CVSS 3.xCRITICAL 9.8
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
CVE-2023-5551
LOW3.3

Separate Groups mode restrictions were not honoured in the forum summary report, which would display users from other groups.

Published: 2023-11-09Modified: 2024-11-21
CVSS 3.xLOW 3.3
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
References
GHSA-243v-5pff-qqfj
MEDIUM6.1

Moodle Open redirect risk in mobile auto-login feature

Published: 2022-07-26Modified: 2024-04-24
CVSS 3.xMEDIUM 6.1
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
References
GHSA-26fg-v32r-h663
MEDIUM5.3

Moodle Exposure of Sensitive Information to an Unauthorized Actor vulnerability

Published: 2023-11-10Modified: 2023-11-18
CVSS 3.xMEDIUM 5.3
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
References
GHSA-28gc-4qq5-8q26
MEDIUM6.1

Moodle Cross-site Scripting vulnerability

Published: 2023-11-10Modified: 2023-11-15
CVSS 3.xMEDIUM 6.1
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
References
GHSA-3xxm-3g3c-w579
MEDIUM4.7

Moodle Code Injection vulnerability

Published: 2023-11-10Modified: 2023-11-10
CVSS 3.xMEDIUM 4.7
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
References
GHSA-49mv-vfcp-8gg9
MEDIUM6.3

Moodle vulnerable to SQL Injection

Published: 2023-06-23Modified: 2024-04-19
CVSS 3.xMEDIUM 6.3
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
References
GHSA-56r9-72vx-q989
MEDIUM6.5

Moodle arbitrary file read vulnerability

Published: 2023-03-24Modified: 2024-04-19
CVSS 3.xMEDIUM 6.5
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
References
GHSA-5cvx-cwpx-9rjh
MEDIUM6.5

Moodle Code Injection vulnerability

Published: 2023-11-10Modified: 2023-11-10
CVSS 3.xMEDIUM 6.5
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
References
GHSA-62wh-m4jr-233r
MEDIUM6.1

Moodle LTI module reflected XSS risk

Published: 2022-07-26Modified: 2024-04-24
CVSS 3.xMEDIUM 6.1
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
References
GHSA-6gx2-g773-hv9h
MEDIUM6.1

Moodle reflected cross-site scripting vulnerability in policy tool

Published: 2022-11-23Modified: 2024-04-24
CVSS 3.xMEDIUM 6.1
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
References
GHSA-72w2-j52c-7682
HIGH8.8

Moodle SQL Injection vulnerability

Published: 2023-03-24Modified: 2024-04-19
CVSS 3.xHIGH 8.8
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
GHSA-77jm-f3vj-xvx2
MEDIUM6.1

Moodle vulnerable to Cross-site Scripting

Published: 2023-03-24Modified: 2024-04-19
CVSS 3.xMEDIUM 6.1
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
References
GHSA-7h8v-2v8x-h264
MEDIUM6.5

SQL Injection in moodle

Published: 2021-03-29Modified: 2021-03-25
CVSS 3.xMEDIUM 6.5
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
References
GHSA-7mmc-22g7-3xq2
HIGH7.3

Moodle SQL Injection vulnerability

Published: 2023-05-03Modified: 2024-04-19
CVSS 3.xHIGH 7.3
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
References
GHSA-8v23-w4w5-w83c
MEDIUM5.4

Cross-Site Request Forgery in Moodle

Published: 2022-11-23Modified: 2022-11-26
CVSS 3.xMEDIUM 5.4
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
References
GHSA-948f-j464-rfj2
MEDIUM4.3

Moodle may allow students to bypass sequential navigation during a quiz attempt

Published: 2023-03-25Modified: 2023-03-30
CVSS 3.xMEDIUM 4.3
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
References
GHSA-9f45-9qrw-pp4v
MEDIUM6.1

Moodle vulnerable to Cross-site Scripting when algebra filter enabled but not functional

Published: 2023-03-24Modified: 2024-04-19
CVSS 3.xMEDIUM 6.1
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
References
GHSA-9gqp-3g28-w9xc
MEDIUM6.1

Moodle Cross-site Scripting vulnerability

Published: 2023-11-10Modified: 2023-11-15
CVSS 3.xMEDIUM 6.1
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
References
GHSA-c7v4-m269-4995
MEDIUM5.3

Exposure of Sensitive Information to an Unauthorized Actor in Moodle

Published: 2021-10-21Modified: 2021-10-20
CVSS 3.xMEDIUM 5.3
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
References
GHSA-c9hq-g4q8-w893
MEDIUM5.3

Privilage Escalation in moodle

Published: 2021-03-29Modified: 2021-03-25
CVSS 3.xMEDIUM 5.3
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
References
GHSA-cwh2-q44x-5w3c
MEDIUM5.3

Moodle Acceptance of Extraneous Untrusted Data With Trusted Data vulnerability

Published: 2023-11-10Modified: 2023-11-18
CVSS 3.xMEDIUM 5.3
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
References
GHSA-fm5h-58g2-4m3f
MEDIUM5.3

Moodle Improper Access Control vulnerability

Published: 2023-11-10Modified: 2023-11-18
CVSS 3.xMEDIUM 5.3
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
References
GHSA-h77r-rp97-7rv4
HIGH7.5

Privilage Escalation in moodle

Published: 2021-03-29Modified: 2021-10-20
CVSS 3.xHIGH 7.5
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
References
GHSA-j5xf-gv89-g422
MEDIUM5.4

Moodle Cross-site Scripting vulnerability

Published: 2023-11-10Modified: 2023-11-15
CVSS 3.xMEDIUM 5.4
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
References
GHSA-jr83-8x65-xcr5
LOW3.3

Moodle Exposure of Sensitive Information to an Unauthorized Actor vulnerability

Published: 2023-11-10Modified: 2023-11-18
CVSS 3.xLOW 3.3
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
References
GHSA-pgcp-m69h-p2gr
MEDIUM6.1

Cross-site Scripting (XSS) in moodle

Published: 2021-03-29Modified: 2021-03-25
CVSS 3.xMEDIUM 6.1
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
References
GHSA-pgm5-cr62-prxq
HIGH7.5

Moodle Arbitrary file read when importing lesson questions

Published: 2022-07-26Modified: 2024-04-24
CVSS 3.xHIGH 7.5
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
References
GHSA-prjm-2fj2-787f
MEDIUM4.3

Moodle may allow teachers to access the names of users they could not otherwise access

Published: 2023-03-24Modified: 2024-04-19
CVSS 3.xMEDIUM 4.3
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
References
GHSA-q2x3-2f9g-h559
CRITICAL9.8

Moodle's Mustache pix helper contained a potential Mustache injection risk if combined with user input

Published: 2023-03-24Modified: 2024-04-19
CVSS 3.xCRITICAL 9.8
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
GHSA-vj5p-fp42-774p
MEDIUM4.3

Moodle may display roles to users who don't have access to them

Published: 2023-03-24Modified: 2024-04-19
CVSS 3.xMEDIUM 4.3
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
References
GHSA-vxhx-gmhm-623c
HIGH7.5

Improper Access Control in moodle

Published: 2021-03-29Modified: 2021-03-25
CVSS 3.xHIGH 7.5
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
References
GHSA-w8x2-w4qr-v3x4
HIGH8.8

Moodle Code Injection vulnerability

Published: 2023-11-10Modified: 2023-11-18
CVSS 3.xHIGH 8.8
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
GHSA-wwv7-h477-wrv7
MEDIUM6.1

Moodle Stored XSS and blind SSRF possible via SCORM track details

Published: 2022-07-26Modified: 2024-04-24
CVSS 3.xMEDIUM 6.1
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
References
GHSA-xp2f-9mx3-3c6p
CRITICAL9.8

Moodle PostScript Code Injection

Published: 2022-07-26Modified: 2024-04-24
CVSS 3.xCRITICAL 9.8
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
GHSA-xqcf-vgqc-pcmg
CRITICAL9.1

Moodle blind Server-Side Request Forgery (SSRF) vulnerability in LTI provider library

Published: 2022-11-26Modified: 2025-04-29
CVSS 3.xCRITICAL 9.1
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
References
GHSA-xxp4-mf4h-6cwm
HIGH7.5

Moodle vulnerable to Server Side Request Forgery

Published: 2023-06-23Modified: 2024-04-19
CVSS 3.xHIGH 7.5
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
References