The XML grade import functionality (which allows setting or overwriting of student grades) did not include the necessary token to prevent a CSRF risk.
Version checkMoodle 3.3.8
Moodle 3.3.8 3.3 no longer receives security fixes
Released 10 Sep 2018. Moodle 3.3 had its last security release, 3.3.9, on 12 Nov 2018, and its security support ended 12 Nov 2018. Advisories published since then list it only as an earlier unsupported version.
270 security advisories since 3.3.8
269 of them were published after 3.3 left security support, so no 3.3 release fixes them. The fix is a major upgrade: 4.5.14 is the current long-term support release, 5.2.3 the newest.
270
Advisories
116
Serious
154
Minor
269
Not fixed in 3.3
16
CVE pending
Group by
270 advisories, newest firstSerious116
An incorrect capability check in a grade web service allowed students to access profile information of other students enrolled in the same course, which they would not otherwise have access to.
An SQL injection risk was identified in a question bank web service.
Incorrect handling of IPv4-mapped IPv6 addresses could allow bypassing of some blocked hosts, resulting in an SSRF risk.
User profile descriptions for authenticated users posed a denial of service risk due to the absence of a defined maximum length.
Insufficient capability checks in the Assignment module's marker allocation functionality allowed users without the required capability to allocate markers to submissions.
The regrade action in the quiz overview report did not include the necessary token to prevent a CSRF risk.
The grade item ID number editing functionality did not include the necessary token to prevent a CSRF risk and also lacked sufficient output sanitizing to prevent an XSS risk.
Additional checks were required to ensure users with the capability to delete comments can only do so in the contexts where they have the permission.
A remote code execution risk was identified in the admin presets import feature. Note: This feature is only available to site administrators.
An arbitrary file read risk was identified in the backup restore functionality.
A flaw in email-based multi-factor authentication made it possible for a user to bypass another user's MFA token check if using the email factor. Note: Valid login credentials (such as username and password) were still required to log into the account.
An arbitrary file read risk was identified in the Database Activity module's import feature.
A remote code execution risk was identified in Moodle's Google Drive repository plugin.
An SQL injection risk was identified in the "external database" authentication plugin (auth_db). Note: This only affected sites with the auth_db authentication plugin enabled.
Rendering of TeX content with mimetex in the formula editor required execution time limitations to prevent a denial of service risk.
Additional sanitizing was required on a TeX filter administration setting to prevent a remote code execution risk.
A remote code execution risk was identified in the file restore functionality.
The return URL in the policy tool required extra sanitizing to prevent a reflected XSS risk.
Insufficient sanitizing when exporting data to CSV / XLSX format could result in malicious formulas being inserted into the files.
Insufficient sanitizing in the formula editor could result in an XSS risk.
Suspended users were not prevented from authenticating via the LTI Provider
A remote code execution risk was identified in the file restore functionality.
The upstream FPDI library was upgraded, which included a security fix.
Insufficient authorisation checks could result in users being able to view BigBlueButton recordings they did not have permission to access.
Insufficient state and capability checks resulted in some details of hidden courses (such as course name, description and teachers) being available to users who did not have permission to access them.
A DNS rebind risk in the way cURL requests were handled could result in an SSRF risk, due to the possibility of cURL blocked hosts / allowed ports site configurations being bypassed.
The upstream ADOdb library contained an SQL injection risk in the pg_insert_id() method. It is important to note that the core Moodle LMS was NOT affected by this vulnerability, however as a precaution, this library has been upgraded to remove the risk entirely, in case any third party code/plugins uses the vulnerable code.
The return URL in the policy tool required extra sanitizing to prevent a reflected XSS risk.
A remote code execution risk was identified in the Moodle LMS EQUELLA repository. By default this was only available to teachers and managers, on sites with the EQUELLA repository enabled.
A remote code execution risk was identified in the Moodle LMS Dropbox repository. By default this was only available to teachers and managers, on sites with the Dropbox repository enabled.
Insufficient sanitizing in an undocumented MimeTeX command resulted in a remote code execution risk for sites using MimeTeX (via the TeX Notation filter).
An SQL injection risk was identified in the module list filter within course search.
Description information displayed in the site administration live log required additional sanitizing to prevent a stored XSS risk.
Insufficient sanitizing in the TeX notation filter resulted in an arbitrary file read risk on sites where pdfTeX is available (such as those with TeX Live installed).
Guest user sessions were given a longer timeout than authenticated users, which could result in an elevated denial of service risk.
Insufficient capability checks in a learning plan web service could result in users having the ability to retrieve information they did not have permission to access (such as users' names).
Dynamic tables did not enforce capability checks, which resulted in users having the ability to retrieve information they did not have permission to access.
A local file include risk when restoring block backups was identified.
H5P error messages required additional sanitizing to prevent a reflected XSS risk.
An SQL injection risk was identified in the XMLDB editor tool available to site administrators
The bulk message sending feature for the Feedback module's non-respondents report had an incorrect CSRF token check, resulting in a CSRF risk.
Insufficient capability checks made it possible to delete badges a user does not have permission to access.
Additional localstorage validation was required to mitigate a cache poisoning risk.
Insufficient sanitizing in the TeX notation filter resulted in an arbitrary file read risk on sites where pdfTeX is available (such as those with TeX Live installed).
Additional restrictions were required to avoid a remote code execution risk in calculated question types. (Note: This required the capability to add/update questions.)
Incorrect CSRF token checks resulted in multiple CSRF risks.
SeriousMSA-24-0016Authenticated LFI risk in some misconfigured shared hosting environments via modified mod_data backup
In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user with both access to restore database activity modules and direct access to the web server outside of the Moodle webroot could execute a local file include.
SeriousMSA-24-0015Authenticated LFI risk in some misconfigured shared hosting environments via modified mod_wiki backup
In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user with both access to restore wiki modules and direct access to the web server outside of the Moodle webroot could execute a local file include.
SeriousMSA-24-0014Authenticated LFI risk in some misconfigured shared hosting environments via modified mod_workshop backup
In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user with both access to restore workshop modules and direct access to the web server outside of the Moodle webroot could execute a local file include.
SeriousMSA-24-0013Authenticated LFI risk in some misconfigured shared hosting environments via modified mod_feedback backup
In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user with both access to restore feedback modules and direct access to the web server outside of the Moodle webroot could execute a local file include.
Incorrect validation of allowed event types in a calendar web service made it possible for some users to create events with types/audiences they did not have permission to publish to.
Insufficient file size checks resulted in a denial of service risk in the file picker's unzip functionality.
A remote code execution risk was identified in course blocks. By default this was only available to teachers and managers.
Insufficient recursion limitations resulted in a denial of service risk in the URL downloader.
A remote code execution risk was identified in logstore. By default this was only available to managers.
In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user who also has direct access to the web server outside of the Moodle webroot could utilise a local file include to achieve remote code execution.
Wiki comments required additional sanitizing and access restrictions to prevent a stored XSS risk and potential IDOR risk.
A remote code execution risk was identified in the IMSCP activity. By default this was only available to teachers and managers.
A remote code execution risk was identified in the Lesson activity. By default this was only available to teachers and managers.
The phpCAS library included with Moodle has been upgraded to version 1.6.0, which includes a fix for a serious security issue.
It was possible to escalate stored self-XSS to stored XSS where users login via OAuth 2.
A remote code execution risk was identified where file repository reference properties are parsed.
Incorrect domain matching logic made it possible to bypass the proxy, which could result in access to hosts intended to be blocked by the proxy.
An issue in the logic used to check 0.0.0.0 against the cURL blocked hosts lists resulted in an SSRF risk.
Content output by the database auto-linking filter required additional sanitizing to prevent an XSS risk.
Insufficient sanitizing in backup resulted in an arbitrary file read risk. The capability to access this feature is only available to teachers, managers and admins by default.
Insufficient validation of profile field availability condition resulted in an SQL injection risk (by default only available to teachers and managers).
Some returnurl parameters required additional sanitizing to prevent a reflected XSS risk.
Moodle's LTI provider library did not utilise Moodle's inbuilt cURL helper, which resulted in a blind SSRF risk.
The return URL in the policy tool required extra sanitizing to prevent a reflected XSS risk.
An upstream security patch was applied to the third party VideoJS library included with Moodle, on versions affected by an XSS risk.
A remote code execution risk when restoring backup files originating from Moodle 1.9 was identified.
SeriousMSA-22-0023Stored XSS and page denial of service risks due to recursive rendering in Mustache template helpers
Recursive rendering of Mustache template helpers containing user input could, in some cases, result in an XSS risk or a page failing to load.
The Mustache template library included with Moodle has been upgraded to the latest version, which includes a fix for a serious security issue.
Insufficient sanitizing of SCORM track details presented stored XSS and blind SSRF risks.
Insufficient path checks in a lesson question import resulted in an arbitrary file read risk. The capability to access this feature is only available to teachers, managers and admins by default.
An omitted execution parameter resulted in a remote code execution risk for sites running GhostScript versions older than 9.50.
An issue in the logic used to count failed login attempts could result in the account lockout threshold being bypassed.
An SQL injection risk was identified in Badges code relating to configuring criteria.
An SQL injection risk was identified in Badges code relating to configuring criteria. Access to the relevant capability was limited to teachers and managers by default.
The "delete badge alignment" functionality did not include the necessary token check to prevent a CSRF risk.
The "delete related badge" functionality did not include the necessary token check to prevent a CSRF risk.
A URL parameter in the filetype site administrator tool required extra sanitizing to prevent a reflected XSS risk.
A remote code execution risk when restoring backup files was identified.
It was possible for a student to view their quiz grade before it had been released, using a quiz web service.
Insufficient escaping of the LaTeX preamble made it possible for site administrators to read files available to the HTTP server system account.
An authentication bypass risk was identified in the external database authentication functionality, due to a type juggling vulnerability.
A session hijack risk was identified in the Shibboleth authentication plugin. ( Note: Shibboleth authentication is disabled by default in Moodle.)
Insufficient capability checks meant message deletions were not limited to the current user.
Insufficient redirect handling made it possible to blindly bypass cURL blocked hosts/allowed ports restrictions, resulting in a blind SSRF risk. ( Note: The request response was still blocked and not available to the user.)
The file repository's URL parsing required additional recursion handling to mitigate the risk of recursion denial of service.
A remote code execution risk was identified in the Shibboleth authentication plugin. ( Note: Shibboleth authentication is disabled by default in Moodle.)
An SQL injection risk was identified in the library fetching a user's recent courses
An SQL injection risk was identified in the library fetching a user's enrolled courses
SeriousMSA-21-0016Files API should mitigate denial-of-service risk when adding to the draft file area
A denial-of-service risk was identified in the draft files area, due to it not respecting user file upload limits.
An SQL injection risk existed on sites with MNet enabled and configured, via an XML-RPC call from the connected peer host. Note that this required site administrator access or access to the keypair.
It was possible for a student to view their quiz grade before it had been released, using a quiz web service.
Text-based feedback answers required additional sanitizing to prevent stored XSS and blind SSRF risks.
The ID number user profile field required additional sanitizing to prevent a stored XSS risk.
It was possible for site administrators to execute arbitrary PHP scripts via a PHP include used during Shibboleth authentication.
If the TeX notation filter was enabled, additional sanitizing of TeX content was required to prevent the risk of stored XSS.
The decompressed size of zip files was not checked against available user quota before unzipping them, which could lead to a denial of service risk.
The filter in the tag manager required extra sanitizing to prevent a reflected XSS risk.
yui_combo needed to limit the amount of files it can load to help mitigate the risk of denial of service.
SeriousMSA-20-0009Course enrolments allowed privilege escalation from teacher role into manager role
Teachers of a course were able to assign themselves the manager role within that course.
It was possible to create a SCORM package in such a way that when added to a course, it could be interacted with via web services in order to achieve remote code execution.
MathJax versions 2.7.2 and earlier contain a stored XSS risk. The MathJax URL has been updated to reference a newer version, which has the vulnerability patched.
X-Forwarded-For headers could be used to spoof a user's IP, in order to bypass remote address checks.
Fatal error messages required extra sanitizing to prevent reflected XSS risks on some pages.
OAuth 2 providers who do not verify users' email address changes require additional verification during sign-up to reduce the risk of account compromise.
SeriousMSA-19-0022Open redirect in the mobile launch endpoint could be used to expose mobile access tokens
The mobile launch endpoint contained an open redirect in some circumstances, which could result in a user's mobile access token being exposed. ( Note: This does not affect sites with a forced URL scheme configured, mobile service disabled, or where the mobile app login method is "via the app").
SeriousMSA-19-0018JavaScript injection possible in some Mustache templates via recursive rendering from contexts
Mustache helper tags that were included in template contexts were not being escaped before that context was injected into another Mustache helper, which could result in script injection in some templates.
Users could assign themselves an escalated role within courses or content accessed via LTI, by modifying the request to the LTI publisher site.
Users with the "login as other users" capability (such as administrators/managers) can access other users' Dashboards, but the JavaScript those other users may have added to their Dashboard was not being escaped when being viewed by the user logging in on their behalf.
The login form is not protected by a token to prevent login cross-site request forgery.
Minor154
User list filters allowed managers to filter by user profile fields that they could not view on users' profiles.
Insufficient username escaping could allow a minor XSS risk if an unauthenticated user was tricked into opening a password reset link (so did not affect authenticated user sessions).
An incorrect capability check in the AI "generate image" web service could allow users to access that feature without having the "generate image" capability.
The manual enrolment management page did not prevent direct access when the plugin was disabled and a link was no longer available in the UI. Note: This still required the relevant capability to access the page (had it been enabled).
Insufficient escaping resulted in an XSS risk in some templates used to display forum posts.
Insufficient validation of the audience classname in report builder allowed arbitrary class instantiation.
The report builder fragment output callbacks did not verify that the requesting user had the required capability to access the requested report, potentially allowing users to retrieve report data beyond their permitted access.
A blind SSRF risk was identified in the MNet peers management functionality, due to missing validation of peer hostnames against the cURL blocked hosts configuration. Note: This feature is only available to site administrators.
Capability checks were missing from course assistance AI placement web services, which could allow users to make requests to those AI course assistance web services without having the relevant capabilities (if those features are enabled).
The quiz feature to add section headings did not include the necessary token to prevent a CSRF risk.
The actions to enable and disable group messaging did not include the necessary token to prevent a CSRF risk.
The Feedback activity module's import functionality required additional sanitizing to prevent a reflected XSS risk.
The user profile page reset action did not include the necessary token to prevent a CSRF risk.
The setting for users to set their own homepage preference did not include the necessary token to prevent a CSRF risk.
Missing group access checks in some grade web services could allow a user to access grade and user information for students in groups they did not have permission to view.
Insufficient CSRF token and capability checks were applied to an MNet admin setting.
The upstream AWS SDK for PHP library was upgraded, which included a security fix.
A flaw in message handling of conversations with deleted users could result in active users losing access to their private messages.
When blind marking is enabled for an assignment, user IDs remained visible on the assignment submissions page instead of being masked.
Badges being awarded with a role performed the correct capability check, but did not verify the user had the required role to meet the award criterion.
Forum ratings required additional permission checks to prevent users from being able to view ratings they did not have the capability to access.
Insufficient checks on a confirmation email web service made it easier to brute force password checks against known usernames.
An open redirect risk existed in the OAuth login functionality.
There was a behaviour that made it possible for a student to bypass the timed restriction on a timed assignment.
MinorMSA-25-0049Names of hidden groups are visible to users with access to create group calendar events
Insufficient capability checks meant users with the capability to create group events, but without the capability to view hidden groups, could see hidden and separate groups in the list of groups to select for calendar events.
It was possible to brute force password checks against known usernames when the mobile client and auth_webservice were enabled.
Insufficient capability checks meant a user with permission to manage/view cohorts in a lower context could retrieve data about cohorts defined in the system context, that they would not otherwise have access to.
MinorMSA-25-0040Capabilities and callback that control access to profiles not working in some web services
Insufficient capability checks meant a callback designed to allow plugins to control user profile access did not correctly limit access in some web service functions.
Feedback activity results for all groups in Separate Groups mode could be viewed by non-editing teachers when they were not a member of any group.
Separate Groups mode restrictions were not honoured when viewing a course's Logs report, so actions of all course participants were displayed in the report. By default this only provided additional access to non-editing teachers.
A stricter capability check was required to restrict which users can fetch other users' recently accessed courses information.
The "move up" and "move down" actions in backpack management for badges did not include the necessary token to prevent a CSRF risk.
Additional cache controls were required to prevent web browsers caching a user's password on the login page (note accessing this would require access to the web browser on the device where the user had logged in).
Additional checks were required to ensure users can only fetch cohort data they are intended to have access to.
Insufficient capability checks in a messaging web service made it possible to view other users' names and online status.
Additional checks were required to prevent users deleting course sections they did not have permission to modify.
MinorMSA-25-0022IDOR in web service allows users enrolled in a course to access some details of other users
Insufficient capability checks made it possible for a user enrolled in a course to access some details (full name and profile image URL) of other users they did not have permission to access.
The analysis request action in the Brickfield tool did not include the necessary token to prevent a CSRF risk.
A user's CSRF token was unnecessarily included in the URL on the database module's edit and delete pages.
Insufficient capability checks made it possible to view RSS feed content a user does not have permission to access.
The user tours duplicate tour action did not include the necessary token to prevent a CSRF risk.
Insufficient capability checks in some grade reports resulted in some hidden grades being available to users who did not have permission to view them.
Additional checks were required to ensure trusttext is applied (when enabled) to glossary entries being restored.
Insufficient capability checks made it possible to disable badges a user does not have permission to access.
The upstream RequireJS library was upgraded, which included a security fix.
The drag-and-drop onto image (ddimageortext) question type required additional sanitizing to prevent a stored XSS risk.
MinorMSA-25-0003Non-searchable tags can still be discovered on the tag search page and in the tags block
Tags not expected to be visible to a user could still be discovered by them via the tag search page or in the tags block.
Separate Groups mode restrictions were not factored into permission checks before allowing viewing or deletion of responses in Feedback activities.
In a database activity with separate groups mode enabled, users who were not in a group (and did not have permission to access all groups) could see entries from members of all groups in the activity, rather than just entries of users also not in any groups. Note: Users within groups worked as intended, only able to see entries belonging to other members of their group(s).
On sites requiring a confirmation step to update a user's email address, the token used to verify the change should only be accessible via the confirmation email, but was otherwise retrievable by the user.
Insufficient checks meant users could see users tagged with a tag, regardless of whether they had access to view the users' profiles.
Additional checks were required to ensure users can only access the schedule of a report if they have permission to edit that report.
Users with access to delete audiences from some reports could delete audiences from other reports they did not have permission to delete from.
Additional checks were required to ensure users can only edit or delete RSS feeds they have permission to modify.
It was possible for users with the "send message" capability to view other users' names they may not otherwise have access to, via an error message in Messaging. (Note: The name returned followed the full name format configured on the site).
When restricting access to a Lesson activity with a password, certain passwords could be bypassed/less secure due to a loose comparison in the password checking logic.
Additional checks were required to ensure users can only delete their own OAuth2 linked accounts.
Bulk messaging in the Feedback activity's non-respondents report did not verify message recipients belong to the set of users returned by the report.
Insufficient sanitizing of data when performing a restore could result in an XSS risk from malicious backup files.
Insufficient capability checks made it possible for users with access to restore glossaries in courses to restore them into the global site glossary.
The cURL wrapper in Moodle stripped HTTPAUTH and USERPWD headers during emulated redirects, but retained other original request headers, so HTTP authorization header information could be unintentionally sent in requests to redirect URLs.
Some hidden user profile fields were visible in gradebook reports, which could result in some users without the "view hidden user fields" capability having access to the information.
When creating an export of site administration presets, some sensitive secrets/keys were not being excluded from the export, which could result in them being unintentionally leaked if the presets were shared with a third party.
MinorMSA-24-0025QR login key and auto-login key for the Moodle mobile app should be generated as separate keys
A unique key should be generated for a user's QR login key and their auto-login key, so the same key cannot be used interchangeably between the two.
The cURL wrapper in Moodle retained the original request headers when following redirects, so HTTP authorization header information could be unintentionally sent in requests to redirect URLs.
Insufficient escaping of calendar event titles resulted in a stored XSS risk in the event deletion prompt.
MinorMSA-24-0021BigBlueButton web service leaks meeting joining information to users who should not have access
Insufficient capability checks meant it was possible for users to gain access to BigBlueButton join URLs they did not have permission to access.
Actions in the admin management of analytics models did not include the necessary token to prevent a CSRF risk.
The site log report required additional encoding of event descriptions to ensure any HTML in the content is displayed in plaintext instead of being rendered.
Actions in the admin preset tool did not include the necessary token to prevent a CSRF risk.
ID numbers displayed in the lesson overview report required additional sanitizing to prevent a stored XSS risk.
Insufficient escaping of participants' names in the participants page table resulted in a stored XSS risk when interacting with some features.
Additional sanitizing was required when opening the equation editor, to prevent a stored XSS risk when editing another user's equation.
Insufficient checks in a web service made it possible to add comments to the comments block on another user's dashboard when it was not otherwise available (eg on their profile page).
The link to update all installed language packs did not include the necessary token to prevent a CSRF risk.
Separate Groups mode restrictions were not honoured when performing a forum export, which would export forum data for all groups. By default this only provided additional access to non-editing teachers.
Separate Groups mode restrictions were not honoured in the H5P attempts report, which would display users from other groups. By default this only provided additional access to non-editing teachers.
The URL parameters accepted by forum search were not limited to the allowed parameters.
The mtrace output when running a task in the admin UI required additional sanitizing to prevent an XSS risk.
Insufficient capability checks meant it was possible for all users to view the recipients of badges.
Separate Groups mode restrictions were not honoured in survey response reports, which would display users from other groups.
Separate Groups mode restrictions were not honoured in the Logs and Live logs course reports, which would display users from other groups.
Separate Groups mode restrictions were not honoured in the forum summary report, which would display users from other groups.
Insufficient web service capability checks made it possible to move categories a user had permission to manage, to a parent category they did not have the capability to manage.
Stronger revision number limitations were required on file serving endpoints to improve cache poisoning protection.
The course upload preview contained an XSS risk for users uploading unsafe data.
H5P metadata automatically populated the author with the user's username, which could be sensitive information.
The CSV grade import method contained an XSS risk for users importing the spreadsheet, if it contained unsafe content.
Insufficient limitations made it possible for students to bypass sequential navigation during a quiz attempt.
Insufficient capability checks resulted in competency framework tools being available to users without the relevant capability.
The admin view all policies page URL required additional sanitizing to prevent an open redirect risk.
The JQuery UI library included with Moodle has been upgraded to version 1.13.2, which includes fixes for security issues.
Insufficient capability checks made it possible to fetch other users' message processor preferences data.
Permission overrides on individual blocks in the system dashboard did not cascade to user dashboards.
A limited SQL injection risk was identified on the Mnet SSO access control page.
A limited SQL injection risk was identified in functionality used by the Wiki activity when listing pages.
The course participation report required additional checks to prevent roles being displayed which the user did not have access to view.
Insufficient filtering of grade report history made it possible for teachers to access the names of users they could not otherwise access.
The Mustache pix helper contained a potential Mustache injection risk if combined with user input (note: This did not appear to be implemented/exploitable anywhere in the core Moodle LMS).
If the algebra filter was enabled but not functional (eg the necessary binaries were missing from the server), it presented an XSS risk.
Insufficient limitations on the "start page" preference made it possible to set that preference for another user. (Note: This was still limited to the pre-defined start page options)
A user's CSRF token was unnecessarily included in the URL when being redirected to a course they have just restored.
Insufficient limitations in some quiz web services made it possible for students to bypass sequential navigation during a quiz attempt.
The H5P activity attempts report did not filter by groups, which in separate groups mode could reveal information to non-editing teachers about attempts/users in groups they should not have access to.
A limited SQL injection risk was identified in the "browse list of users" site administration page.
MinorMSA-22-0020Upgrade moodle-mlbackend-python and update its reference in /lib/mlbackend/python/classes/processor.php (upstream)
The upstream Moodle machine learning backend and its reference in /lib/mlbackend/python/classes/processor.php were upgraded, which includes some security updates.
A minor reflected XSS risk was identified in the LTI module. This did not impact authenticated users.
The mobile auto-login URL required additional sanitizing to prevent an open redirect risk.
Global search results could include author information on some activities where a user may not otherwise have access to it.
The description user field was not hidden when being set as a hidden user field.
ID numbers displayed when bulk allocating markers to assignments required additional sanitizing to prevent a stored XSS risk.
The CKEditor included in the h5p-editor-php-library within Moodle has been upgraded to the latest version, which includes security fixes.
The PHPMailer library included with Moodle has been upgraded to the latest version, which includes security fixes.
Users with the capability to configure badge criteria (teachers and managers by default) were able to configure course badges with profile field criteria, which should only be available for site badges.
MinorMSA-22-0006Users with moodle/site:uploadusers but without moodle/user:delete could delete users
Insufficient capability checks could allow users with the moodle/site:uploadusers capability to delete users, without having the necessary moodle/user:delete capability.
MinorMSA-22-0003Capability gradereport/user:view not always respected when navigating to a user's course grade report
Insufficient capability checks could lead to users accessing their grade report for courses where they did not have the required gradereport/user:view capability.
The calendar:manageentries capability allowed managers to access or modify any calendar event, but should have been restricted from accessing user level events.
Insufficient capability checks made it possible to fetch other users' calendar action events.
MinorMSA-21-0039Upgrade moodle-mlbackend-python and update its reference in /lib/mlbackend/python/classes/processor.php (upstream)
The upstream Moodle machine learning backend and its reference in /lib/mlbackend/python/classes/processor.php were upgraded, which includes some security updates.
Insufficient capability checks made it possible for teachers to download users outside of their courses.
In some circumstances, email notifications of messages could have the link back to the original message hidden by HTML, which may pose a phishing risk.
Users' names required additional sanitizing in the account confirmation email, to prevent a self-registration phishing risk.
ID numbers exported in HTML data formats required additional sanitizing to prevent a local stored XSS risk. Note that the XSS was part of the locally downloaded file and not on the Moodle site's domain.
Insufficient capability checks made it possible to remove other users' calendar URL subscriptions.
The redirect URI in the LTI authorization endpoint required extra sanitizing to prevent reflected XSS and open redirect risks.
ID numbers displayed in the quiz grading report required additional sanitizing to prevent a stored XSS risk.
The JQuery version used by Moodle required upgrading to 3.5.1 to patch some published potential vulnerabilities.
MinorMSA-21-0010Fetching a user's enrolled courses via web services did not check profile access in each course
The web service responsible for fetching other users' enrolled courses did not validate that the requesting user had permission to view that information in each course.
When creating a user account, it was possible to verify the account without having access to the verification email link/secret.
It was possible for some users without permission to view other users' full names to do so via the online users block.
Messaging did not impose a character limit when sending messages, which could result in client-side (browser) denial of service for users receiving very large messages.
If the upload course tool was used to delete an enrolment method which did not exist or was not already enabled, the tool would erroneously enable that enrolment method. This could lead to unintended users gaining access to the course.
Some database module web services allowed students to add entries within groups they did not belong to.
Insufficient capability checks could lead to users with the ability to course restore adding additional capabilities to roles within that course.
Users' enrolment capabilities were not being sufficiently checked when they restored into an existing course, which could lead to them unenrolling users without having permission to do so.
Users with "Log in as" capability in a course context (typically, course managers) may gain access to some site administration capabilities by "logging in as" a System manager.
Insufficient input escaping was applied to the PHP unit webrunner admin tool.
Users viewing the grade history report without the 'access all groups' capability were not restricted to viewing grades of users within their own groups.
An open redirect existed in the Lesson edit page.
When a cohort role assignment was removed, the associated capabilites were not being revoked (where applicable).
MinorMSA-19-0023Forum subscribe link contained an open redirect if forced subscription mode was enabled
If a forum's subscription mode was set to "forced subscription", the forum's subscribe link contained an open redirect.
MinorMSA-19-0021Activity :addinstance capabilities were not respected when creating a course in single activity format
Activity creation capabilities were not correctly respected when selecting the activity to use for a course in single activity mode.
The analytics Python Machine Learning backend has received some security fixes, resulting in the required PIP package version being increased. ( Note: Sites using the PHP ML backend, or not using analytics are not affected)
MinorMSA-19-0019Course creation did not check the creator's role assignment capability before automatically assigning them as a teacher in the course
Users with the capability to create courses were assigned as a teacher in those courses, regardless of whether they had the capability to be automatically assigned that role.
The third party TCPDF library used by Moodle required updating to patch bug fixes, including a security fix (see CVE for more details).
Teachers in an assignment group could modify group overrides for other groups in the same assignment.
Teachers in a quiz group could modify group overrides for other groups in the same quiz.
Users with permission to delete entries from a glossary were able to delete entries from other glossaries they did not have direct access to.
A sesskey (CSRF) token was not being utilised by the XML loading/unloading admin tool.
The size of users' private file uploads via email were not correctly checked, so their quota allowance could be exceeded.
The form to upload cohorts contained a redirect field, which was not restricted to internal URLs.
Links within assignment submission comments would open directly (in the same window). Although links themselves may be valid, opening within the same window and without the no-referrer header policy made them more susceptible to exploits.
The /userpix/ page did not escape users' full names, which are included as text when hovering over profile images. Note this page is not linked to by default and its access is restricted.
The 'manage groups' capability did not have the 'XSS risk' flag assigned to it, but does have that access in certain places. Note that the capability is intended for use by trusted users, and is only assigned to teachers and managers by default.
You are here: Moodle 3.3.8
Released 10 Sep 2018. Each release below closes the advisories listed under it.
Moodle 3.3.912 Nov 2018 · 1 advisoryLast release1 Serious
No 3.3 releasePublished after 12 Nov 2018, when 3.3 left security support · 269 advisories115 Serious154 Minor
MinorMSA-26-0040User list filters do not respect user profile field visibilityCVE pendingMDL-87518moodle.org
MinorMSA-26-0036Incorrect capability check in AI editor placement "generate image" serviceCVE pendingMDL-88587moodle.org
MinorMSA-26-0035Manual enrolment does not correctly observe disabled state of pluginCVE pendingMDL-88593moodle.org
MinorMSA-26-0033Arbitrary class instantiation via audience classname in core_reportbuilderCVE pendingMDL-89078moodle.org
SeriousMSA-26-0032User profile information disclosure via grade web serviceCVE pendingMDL-89381moodle.org
SeriousMSA-26-0030SSRF risk in URL downloader (bypass some blocked hosts)CVE pendingMDL-88779moodle.org
MinorMSA-26-0029Missing capability checks in report builder fragment callbacksCVE-2026-58348MDL-84535moodle.org
SeriousMSA-26-0026Missing capability check in Assignment marker allocationCVE-2026-58345MDL-88529moodle.org
MinorMSA-26-0024Missing capability checks in AI placement web servicesCVE-2026-58343MDL-88533moodle.org
SeriousMSA-26-0012Arbitrary file read risk in Database activity moduleCVE-2026-58331MDL-88595moodle.org
MinorMSA-26-0011CSRF and missing capability check in admin/mnet/peers.phpCVE-2026-7278MDL-84495moodle.org
MinorMSA-26-0010Upgrade AWS SDK for PHP including security fix (upstream)CVE-2025-14761MDL-87598moodle.org
MinorMSA-26-0007Message panel breaks with messages from deleted users (messaging DoS risk)CVE-2026-7276MDL-87760moodle.org
SeriousMSA-26-0006RCE risk via Moodle's Google Drive repository pluginCVE-2026-7275MDL-88423moodle.org
SeriousMSA-26-0005SQL injection risk in external database authentication pluginCVE-2026-7274MDL-88138moodle.org
SeriousMSA-26-0002Remote code execution risk in TeX filter admin settingCVE-2026-26046MDL-87843moodle.org
MinorMSA-25-0061User IDs exposed in URLs when using anonymous submissions in assignmentCVE-2025-67857MDL-82808moodle.org
MinorMSA-25-0060Badges with a role criterion could be awarded to users who do not hold the roleCVE-2025-67856MDL-86507moodle.org
MinorMSA-25-0058Participants can access forum ratings without permissionCVE-2025-67854MDL-86960moodle.org
MinorMSA-25-0057Password brute force risk from confirmation email web serviceCVE-2025-67853MDL-86326moodle.org
SeriousMSA-25-0055Formula injection risk when exporting data to CSV / ExcelCVE-2025-67851MDL-72744moodle.org
SeriousMSA-25-0052Authentication via LTI Provider available to suspended usersCVE-2025-67848MDL-87286moodle.org
MinorMSA-25-0049Names of hidden groups are visible to users with access to create group calendar eventsCVE-2025-62400MDL-86261moodle.org
MinorMSA-25-0048Password brute force risk when mobile/web services enabledCVE-2025-62399MDL-86327moodle.org
MinorMSA-25-0044External cohort search service method leaks system cohort dataCVE-2025-62395MDL-85421moodle.org
MinorMSA-25-0040Capabilities and callback that control access to profiles not working in some web servicesCVE-2025-62438MDL-63395moodle.org
MinorMSA-25-0039Feedback activity results did not always respect Separate Groups modeCVE-2025-62437MDL-84463moodle.org
MinorMSA-25-0038Course Logs report did not respect Separate Groups modeCVE-2025-62436MDL-84464moodle.org
MinorMSA-25-0036IDOR allows fetching of recently accessed courses for other users via web serviceCVE-2025-49518MDL-79993moodle.org
SeriousMSA-25-0035Missing authorisation checks in BigBlueButton view pageCVE-2025-49517MDL-84706moodle.org
MinorMSA-25-0030Password can be revealed in login page after log out due to cachingCVE-2025-49513MDL-85323moodle.org
MinorMSA-25-0027IDOR in messaging web service allows access to some user detailsCVE-2025-3645MDL-72704moodle.org
MinorMSA-25-0026AJAX section delete does not respect course_can_delete_section()CVE-2025-3644MDL-83994moodle.org
SeriousMSA-25-0024Authenticated remote code execution risk in the Moodle LMS EQUELLA repositoryCVE-2025-3642MDL-84473moodle.org
SeriousMSA-25-0023Authenticated remote code execution risk in the Moodle LMS Dropbox repositoryCVE-2025-3641MDL-84475moodle.org
MinorMSA-25-0022IDOR in web service allows users enrolled in a course to access some details of other usersCVE-2025-3640MDL-84750moodle.org
MinorMSA-25-0021CSRF risk in Brickfield tool's analysis request actionCVE-2025-3638MDL-84478moodle.org
MinorMSA-25-0020mod_data edit/delete pages pass CSRF token in GET parameterCVE-2025-3637MDL-65356moodle.org
MinorMSA-25-0019IDOR in RSS block allows access to additional RSS feedsCVE-2025-3636MDL-84499moodle.org
MinorMSA-25-0018CSRF risk in user tours manager allows tour duplicationCVE-2025-3635MDL-84479moodle.org
SeriousMSA-25-0013Remote code execution risk via MimeTeX command (upstream)CVE-2024-40446MDL-85152moodle.org
MinorMSA-25-0012Hidden grades are shown to users without permission on some grade reportsCVE-2025-32045MDL-81945moodle.org
SeriousMSA-25-0010SQL injection risk in course search module list filterCVE-2025-26533MDL-84271moodle.org
MinorMSA-25-0009Teachers can evade trusttext config when restoring glossary entriesCVE-2025-26532MDL-84003moodle.org
MinorMSA-25-0008IDOR in badges allows disabling of arbitrary badgesCVE-2025-26531MDL-84239moodle.org
MinorMSA-25-0007Upgrade RequireJS including security fix (upstream)CVE-2024-38999MDL-84023moodle.org
MinorMSA-25-0003Non-searchable tags can still be discovered on the tag search page and in the tags blockCVE-2025-26527MDL-83941moodle.org
MinorMSA-25-0002Feedback response viewing and deletions did not respect Separate Groups modeCVE-2025-26526MDL-79976moodle.org
SeriousMSA-24-0056Potential denial of service risk due to guest sessions' longer timeout periodCVE-2024-55648MDL-61316moodle.org
MinorMSA-24-0054Database activity issue in separate groups mode, for users not in a groupCVE-2024-55646MDL-82757moodle.org
MinorMSA-24-0053Email change confirmation token available via preferenceCVE-2024-55645MDL-82379moodle.org
MinorMSA-24-0052Tag index page displays other users tagged with the selected tagCVE-2024-55644MDL-82963moodle.org
SeriousMSA-24-0051Unprotected access to sensitive information via learning plan web serviceCVE-2024-55643MDL-83921moodle.org
MinorMSA-24-0044Lesson activity password bypass through PHP loose comparisonCVE-2024-45691MDL-82365moodle.org
SeriousMSA-24-0042Unprotected access to sensitive information via dynamic tablesCVE-2024-45689MDL-82567moodle.org
SeriousMSA-24-0041LFI vulnerability when restoring malformed block backupsCVE-2024-43440MDL-82392moodle.org
MinorMSA-24-0039IDOR in Feedback non-respondents report allows messaging arbitrary site usersCVE-2024-43438MDL-82261moodle.org
MinorMSA-24-0038XSS risk when restoring malicious course backup fileCVE-2024-43437MDL-81394moodle.org
SeriousMSA-24-0037Site administration SQL injection via XMLDB editorCVE-2024-43436MDL-82395moodle.org
MinorMSA-24-0033Authorization headers preserved between "emulated redirects"CVE-2024-43432MDL-82136moodle.org
SeriousMSA-24-0032IDOR in badges allows deletion of arbitrary badgesCVE-2024-43431MDL-82390moodle.org
MinorMSA-24-0030User information visibility control issues in gradebook reportsCVE-2024-43429MDL-79541moodle.org
MinorMSA-24-0028Admin presets export tool includes some secrets that should not be exportedCVE-2024-43427MDL-79373moodle.org
SeriousMSA-24-0026Remote code execution via calculated question typesCVE-2024-43425MDL-82576moodle.org
MinorMSA-24-0025QR login key and auto-login key for the Moodle mobile app should be generated as separate keysCVE-2024-38277MDL-80959moodle.org
MinorMSA-24-0023HTTP authorization header is preserved between "emulated redirects"CVE-2024-38275MDL-81774moodle.org
MinorMSA-24-0022Stored XSS via calendar's event title when deleting the eventCVE-2024-38274MDL-81412moodle.org
MinorMSA-24-0021BigBlueButton web service leaks meeting joining information to users who should not have accessCVE-2024-38273MDL-81778moodle.org
MinorMSA-24-0017Unsanitized HTML in site log for config_log_createdCVE-2024-34006MDL-80585moodle.org
SeriousMSA-24-0016Authenticated LFI risk in some misconfigured shared hosting environments via modified mod_data backupCVE-2024-34005MDL-81267moodle.org
SeriousMSA-24-0015Authenticated LFI risk in some misconfigured shared hosting environments via modified mod_wiki backupCVE-2024-34004MDL-81284moodle.org
SeriousMSA-24-0014Authenticated LFI risk in some misconfigured shared hosting environments via modified mod_workshop backupCVE-2024-34003MDL-80712moodle.org
SeriousMSA-24-0013Authenticated LFI risk in some misconfigured shared hosting environments via modified mod_feedback backupCVE-2024-34002MDL-81135moodle.org
MinorMSA-24-0012CSRF risk in admin preset tool management of presetsCVE-2024-34001MDL-81058moodle.org
MinorMSA-24-0011Stored XSS in lesson overview report via user ID numberCVE-2024-34000MDL-81062moodle.org
MinorMSA-24-0009Stored XSS via user's name on participants page when opening some optionsCVE-2024-33998MDL-81354moodle.org
MinorMSA-24-0008Stored XSS risk when editing another user's equation in equation editorCVE-2024-33997MDL-81352moodle.org
SeriousMSA-24-0007Broken access control when setting calendar event typeCVE-2024-33996MDL-81247moodle.org
MinorMSA-24-0004Forum export did not respect activity group settingsCVE-2024-25981MDL-80504moodle.org
MinorMSA-24-0003H5P attempts report did not respect activity group settingsCVE-2024-25980MDL-80501moodle.org
SeriousMSA-24-0001Denial of service risk in file picker unzip functionalityCVE-2024-25978MDL-74641moodle.org
MinorMSA-23-0052XSS risk when manually running a task in the admin UICVE-2023-6669MDL-80309moodle.org
MinorMSA-23-0047Logs and Live logs course reports did not respect activity group settingsCVE-2023-6664MDL-41465moodle.org
SeriousMSA-23-0046Authenticated remote code execution risk in course blocksCVE-2023-6663MDL-79797moodle.org
SeriousMSA-23-0044Authenticated remote code execution risk in logstore as managerCVE-2023-6661MDL-80174moodle.org
MinorMSA-23-0043Forum summary report shows students from other groups when in Separate Groups modeCVE-2023-5551MDL-79310moodle.org
SeriousMSA-23-0042RCE due to LFI risk in some misconfigured shared hosting environmentsCVE-2023-5550MDL-72249moodle.org
MinorMSA-23-0041Insufficient capability checks when updating the parent of a course categoryCVE-2023-5549MDL-66730moodle.org
MinorMSA-23-0040Make file serving endpoints revision control stricterCVE-2023-5548MDL-77846moodle.org
MinorMSA-23-0037Auto-populated H5P author name causes a potential information leakCVE-2023-5545MDL-78820moodle.org
SeriousMSA-23-0036Stored XSS and potential IDOR risk in Wiki commentsCVE-2023-5544MDL-79509moodle.org
SeriousMSA-23-0031Authenticated remote code execution risk in LessonCVE-2023-5539MDL-79408moodle.org
MinorMSA-23-0029Competency framework tools are not restricted as intendedCVE-2023-40324MDL-66212moodle.org
MinorMSA-23-0027JQuery UI library upgraded to 1.13.2 (upstream)CVE-2022-31160, CVE-2021-41184, CVE-2021-41183, CVE-2021-41182MDL-74544moodle.org
MinorMSA-23-0026IDOR in message processor fragments allows fetching of other users' dataCVE-2023-40322MDL-78792moodle.org
SeriousMSA-23-0023Stored self-XSS escalated to stored XSS via OAuth 2 loginCVE-2023-40320MDL-78685moodle.org
SeriousMSA-23-0020Remote code execution risk when parsing malformed file repository referenceCVE-2023-40317MDL-78647moodle.org
SeriousMSA-23-0018SSRF risk due to insufficient check on the cURL blocked hosts listCVE-2023-35133MDL-78215moodle.org
MinorMSA-23-0017Minor SQL injection risk on Mnet SSO access control pageCVE-2023-35132MDL-77193moodle.org
MinorMSA-23-0015Minor SQL injection risk in external Wiki method for listing pagesCVE-2023-30944MDL-77187moodle.org
MinorMSA-23-0012Course participation report shows roles the user should not seeCVE-2023-1402MDL-75517moodle.org
MinorMSA-23-0011Teacher can access names of users they do not have permission to accessCVE-2023-28336MDL-76809moodle.org
SeriousMSA-23-0006XSS risk when outputting database activity filter dataCVE-2023-28331MDL-76645moodle.org
SeriousMSA-23-0005Authenticated arbitrary file read through malformed backup fileCVE-2023-28330MDL-77204moodle.org
SeriousMSA-23-0004Authenticated SQL injection via availability checkCVE-2023-28329MDL-77046moodle.org
MinorMSA-23-0003Possible to set the preferred "start page" of other usersCVE-2023-23923MDL-76862moodle.org
MinorMSA-22-0029Course restore - CSRF token passed in course redirect URLCVE-2022-45149MDL-75862moodle.org
SeriousMSA-22-0028Apply upstream security fix to VideoJS library to remove XSS riskCVE-2021-23414MDL-75278moodle.org
MinorMSA-22-0027Quiz sequential navigation bypass using web servicesCVE-2022-40208MDL-75210moodle.org
MinorMSA-22-0026No groups filtering in H5P activity attempts reportCVE-2022-40316MDL-71662moodle.org
SeriousMSA-22-0024Remote code execution risk when restoring malformed backup file from Moodle 1.9CVE-2022-40314MDL-75405moodle.org
SeriousMSA-22-0023Stored XSS and page denial of service risks due to recursive rendering in Mustache template helpersCVE-2022-40313MDL-68066moodle.org
MinorMSA-22-0020Upgrade moodle-mlbackend-python and update its reference in /lib/mlbackend/python/classes/processor.php (upstream)CVE pendingMDL-74473moodle.org
MinorMSA-22-0019LTI module reflected XSS risk - affecting unauthenticated users onlyCVE-2022-35653MDL-72299moodle.org
SeriousMSA-22-0017Stored XSS and blind SSRF possible via SCORM track detailsCVE-2022-35651MDL-71921moodle.org
SeriousMSA-22-0016Arbitrary file read when importing lesson questionsCVE-2022-35650MDL-72029moodle.org
SeriousMSA-22-0015PostScript Code Injection / Remote code execution riskCVE-2022-35649MDL-75044moodle.org
MinorMSA-22-0012Global search results reveal authors of content unexpectedly for some activitiesCVE-2022-30598MDL-71623moodle.org
MinorMSA-22-0011Description field hidden by user policies (hiddenuserfields) is still visibleCVE-2022-30597MDL-74318moodle.org
MinorMSA-22-0010Stored XSS in assignment bulk marker allocation form via user ID numberCVE-2022-30596MDL-74204moodle.org
MinorMSA-22-0009Upgrade CKEditor included in h5p-editor-php-library to latest version (upstream)CVE pendingMDL-71722moodle.org
MinorMSA-22-0007Possible to reach the profile field badge criteria on a course pageCVE-2022-0984MDL-74075moodle.org
MinorMSA-22-0006Users with moodle/site:uploadusers but without moodle/user:delete could delete usersCVE-2022-0985MDL-72972moodle.org
MinorMSA-22-0003Capability gradereport/user:view not always respected when navigating to a user's course grade reportCVE-2022-0334MDL-72772moodle.org
MinorMSA-22-0002calendar:manageentries capability allows CRUD access to all calendar eventsCVE-2022-0333MDL-71239moodle.org
MinorMSA-21-0042IDOR in a calendar web service allows fetching of other users' action eventsCVE-2021-43560MDL-71918moodle.org
MinorMSA-21-0039Upgrade moodle-mlbackend-python and update its reference in /lib/mlbackend/python/classes/processor.php (upstream)CVE pendingMDL-70887moodle.org
SeriousMSA-21-0038Remote code execution risk when restoring malformed backup fileCVE-2021-3943MDL-70823moodle.org
SeriousMSA-21-0035Arbitrary file read by site administrators via LaTeX preambleCVE-2021-40694MDL-71240moodle.org
SeriousMSA-21-0034Authentication bypass risk when using external database authenticationCVE-2021-40693MDL-71160moodle.org
MinorMSA-21-0033Course participants download did not restrict which users could be exportedCVE-2021-40692MDL-71726moodle.org
SeriousMSA-21-0032Session Hijack risk when Shibboleth authentication is enabledCVE-2021-40691MDL-71976moodle.org
MinorMSA-21-0031Messaging email notifications containing HTML may hide the final line of the emailCVE-2021-36403MDL-71919moodle.org
MinorMSA-21-0030Insufficient escaping of users' names in account confirmation emailCVE-2021-36402MDL-58393moodle.org
MinorMSA-21-0029Stored XSS when exporting to data formats supporting HTML via user ID numberCVE-2021-36401MDL-71981moodle.org
MinorMSA-21-0028IDOR allows removal of other users' calendar URL subscriptionsCVE-2021-36400MDL-71978moodle.org
SeriousMSA-21-0025Messaging web service allows deletion of other users' messagesCVE-2021-36397MDL-71917moodle.org
SeriousMSA-21-0024Blind SSRF possible against cURL blocked hosts via redirectCVE-2021-36396MDL-71916moodle.org
SeriousMSA-21-0023Recursion denial of service possible due to recursive cURL in file repositoryCVE-2021-36395MDL-71922moodle.org
SeriousMSA-21-0022Remote code execution risk when Shibboleth authentication is enabledCVE-2021-36394MDL-71957moodle.org
SeriousMSA-21-0021SQL injection risk in code fetching recent coursesCVE-2021-36393MDL-71242moodle.org
SeriousMSA-21-0020SQL injection risk in code fetching enrolled coursesCVE-2021-36392MDL-71241moodle.org
MinorMSA-21-0018Reflected XSS and open redirect in LTI authorization endpointCVE-2021-32478MDL-70622moodle.org
SeriousMSA-21-0016Files API should mitigate denial-of-service risk when adding to the draft file areaCVE-2021-32476MDL-69028moodle.org
MinorMSA-21-0015Stored XSS in quiz grading report via user ID numberCVE-2021-32475MDL-71130moodle.org
SeriousMSA-21-0014Blind SQL injection possible via MNet authenticationCVE-2021-32474MDL-70804moodle.org
MinorMSA-21-0011JQuery versions below 3.5.0 contain some potential vulnerabilities (upstream)CVE pendingMDL-69680moodle.org
MinorMSA-21-0010Fetching a user's enrolled courses via web services did not check profile access in each courseCVE-2021-20283MDL-70822moodle.org
MinorMSA-21-0009Bypass email verification secret when confirming account registrationCVE-2021-20282MDL-70668moodle.org
MinorMSA-21-0008User full name disclosure within online users blockCVE-2021-20281MDL-59293moodle.org
SeriousMSA-21-0007Stored XSS and blind SSRF possible via feedback answer textCVE-2021-20280MDL-70767moodle.org
SeriousMSA-21-0005Arbitrary PHP code execution by site admins via Shibboleth configurationCVE-2021-20187MDL-68486moodle.org
MinorMSA-20-0019tool_uploadcourse creates new enrol instances unexpectedly in some circumstancesCVE-2020-25701MDL-69378moodle.org
MinorMSA-20-0018Some database module web services did not respect group settingsCVE-2020-25700MDL-67015moodle.org
MinorMSA-20-0017Privilege escalation within a course when restoring role overridesCVE-2020-25699MDL-56310moodle.org
MinorMSA-20-0016Teacher is able to unenrol users without permission using course restoreCVE-2020-25698MDL-67837moodle.org
SeriousMSA-20-0014Denial of service risk in file picker unzip functionalityCVE-2020-25630MDL-65115moodle.org
MinorMSA-20-0013"Log in as" capability in a course context may lead to some privilege escalationCVE-2020-25629MDL-68974moodle.org
SeriousMSA-20-0009Course enrolments allowed privilege escalation from teacher role into manager roleCVE-2020-14321MDL-69093moodle.org
SeriousMSA-20-0006Remote code execution possible via SCORM packagesCVE-2020-10738MDL-68410moodle.org
SeriousMSA-20-0005MathJax URL upgraded to later version to remove XSS risk (upstream)CVE-2018-1999024MDL-68430moodle.org
MinorMSA-20-0004Admin PHP unit webrunner tool requires additional input escapingCVE-2020-1756MDL-67726moodle.org
MinorMSA-20-0002Grade history report does not respect Separate groups mode in the course settingsCVE-2020-1754MDL-56287moodle.org
SeriousMSA-19-0029Reflected XSS possible from some fatal error messagesCVE-2019-14884MDL-66161moodle.org
SeriousMSA-19-0025Add additional verification for some OAuth 2 logins to prevent account compromiseCVE-2019-14880MDL-66598moodle.org
MinorMSA-19-0024Assigned Role in Cohort did not un-assign on removalCVE-2019-14879MDL-66257moodle.org
MinorMSA-19-0023Forum subscribe link contained an open redirect if forced subscription mode was enabledCVE-2019-14831MDL-55451moodle.org
SeriousMSA-19-0022Open redirect in the mobile launch endpoint could be used to expose mobile access tokensCVE-2019-14830MDL-66501moodle.org
MinorMSA-19-0021Activity :addinstance capabilities were not respected when creating a course in single activity formatCVE-2019-14829MDL-66187moodle.org
MinorMSA-19-0019Course creation did not check the creator's role assignment capability before automatically assigning them as a teacher in the courseCVE-2019-14828MDL-66181moodle.org
SeriousMSA-19-0018JavaScript injection possible in some Mustache templates via recursive rendering from contextsCVE-2019-14827MDL-62284moodle.org
MinorMSA-19-0017Upgrade TCPDF library for PHP 7.3 and bug fixes (upstream)CVE-2018-17057MDL-64794moodle.org
MinorMSA-19-0016Assignment group overrides did not observe separate groups modeCVE-2019-10189MDL-61114moodle.org
MinorMSA-19-0015Quiz group overrides did not observe groups membership or accessallgroupsCVE-2019-10188MDL-34411moodle.org
MinorMSA-19-0014Ability to delete glossary entries that belong to another glossaryCVE-2019-10187MDL-64623moodle.org
MinorMSA-19-0013Missing sesskey (CSRF) token in loading/unloading XML filesCVE-2019-10186MDL-53689moodle.org
MinorMSA-19-0012Private files uploaded via incoming mail processing could bypass quota restrictionsCVE-2019-10134MDL-61738moodle.org
MinorMSA-19-0007Stored HTML in assignment submission comments allowed links to be opened directlyCVE-2019-3850MDL-64651moodle.org
SeriousMSA-19-0006Users could elevate their role when accessing the LTI tool on a provider siteCVE-2019-3849MDL-62702moodle.org
SeriousMSA-19-0004"Log in as" functionality exposed to JavaScript risk on other users' DashboardsCVE-2019-3847MDL-63786moodle.org
MinorMSA-19-0003User full name is not escaped in the un-linked userpix pageCVE-2019-3810MDL-64372moodle.org
Moodle core is one half of the picture
Third-party plugins run with the same privileges as core and never appear in these advisories. MDL Shield reviews plugin code for exactly that gap.
Advisory titles and descriptions are Moodle's own words, from the security announcements on moodle.org, and every entry links to its source. This list is a lower bound: Moodle stops issuing advisories for a branch once it leaves security support. MDL Shield is an independent service and is not affiliated with or endorsed by Moodle Pty Ltd.