Moodle vulnerabilities

In Moodle versions 2.x and 3.x, web service tokens are not invalidated when the user password is changed or forced to be changed.

In Moodle through version 2.6.11, 2.7.x before 2.7.10, 2.8.x before 2.8.8, and 2.9.x before 2.9.2, the random_string and complex_random_string functions rely on the PHP mt_rand function, making it easier for remote attackers to predict password-recovery tokens via a brute-force approach.

The clean_param function in lib/moodlelib.php in Moodle has an open redirect vulnerability that allows remote attackers to redirect users to arbitrary websites.

The generate_password function in Moodle through 2.4.11, and in versions 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 does not provide a sufficient number of possible temporary passwords, allowing remote attackers to gain access via a brute-force attack.

In Moodle versions 2.x and 3.x, SQL injection vulnerability can occur via user preferences.

In Moodle, the XML grade import feature lacks proper Cross-Site Request Forgery (CSRF) token validation. An attacker can trick an authenticated user with grade management permissions into visiting a malicious webpage, triggering unauthorized requests on the victim's behalf. This allows a remote attacker to set or overwrite student grades without authorization.

A flaw was found in Moodle where user list filters do not properly enforce visibility restrictions on user profile fields. An authorized user with manager privileges can filter user lists using profile attributes they are not permitted to view directly, resulting in unauthorized information disclosure by inferring hidden user data.

In Moodle, insufficient sanitization of username input on the password reset page allows a remote attacker to conduct a cross-site scripting (XSS) attack. By convincing an unauthenticated user to access a specially crafted password reset link, an attacker could execute arbitrary script in the victim's browser.

In Moodle, when enrolling a user into a course while assigning them to a group, the application does not verify whether the selected group actually belongs to that course. An authenticated user with teacher privileges could exploit this flaw to add users to groups within courses they do not have authorization to access.

In Moodle, due to a missing capability check, a low-privileged authenticated user can trigger the recalculation of grade penalties without holding the required permissions. This issue allows unauthorized users to modify grade penalty records, potentially altering student assessment scores.

A flaw was found in Moodle where an incorrect capability check in the AI editor placement's image generation web service allows an authenticated user to invoke the feature without holding the required capability. This flaw permits unauthorized users to access and utilize the AI image generation functionality.

A flaw was found in Moodle where the manual enrolment management page did not properly check whether the manual enrolment plugin was disabled, allowing users with enrolment permissions to access the page directly by navigating to its URL. Consequently, an authorized user could manage manual enrolments even after an administrator disabled the feature in the user interface.

In Moodle, insufficient output escaping in templates used to display forum posts enables a stored cross-site scripting (XSS) vulnerability. An attacker can inject malicious content into a forum post, which then executes arbitrary script code in the browser of another user viewing the affected post.

A flaw was found in Moodle that allows an authenticated attacker to supply an improperly validated audience class name to the Report Builder component, enabling arbitrary class instantiation. This vulnerability enables unauthorized creation of internal program objects, which may result in unexpected application behavior.

In Moodle, an incorrect capability check in the grade web service allows an authenticated student to access profile information of other students enrolled in the same course that they should not have permission to view. This issue leads to unauthorized information disclosure.

In Moodle, an authenticated attacker with access to the question bank web service can submit unsanitized input directly into database queries, resulting in a SQL injection vulnerability. This issue could allow an attacker to view, alter, or delete sensitive data stored in the underlying database.

In Moodle, incorrect handling of IPv4-mapped IPv6 addresses within the URL downloader's host-blocking logic allows an authenticated remote user to bypass blocked-host restrictions. By supplying a crafted URL, an attacker can induce the server to make requests to restricted destinations, leading to Server-Side Request Forgery (SSRF).

A Cross Site Scripting (XSS) vulnerability in Moodle CMS v3.10 allows a remote attacker to execute arbitrary code via the Field Name (name parameter) of a new activity.

An issue in the logic used to check 0.0.0.0 against the cURL blocked hosts lists resulted in an SSRF risk. This flaw affects Moodle versions 4.2, 4.1 to 4.1.3, 4.0 to 4.0.8, 3.11 to 3.11.14, 3.9 to 3.9.21 and earlier unsupported versions.

A limited SQL injection risk was identified on the Mnet SSO access control page. This flaw affects Moodle versions 4.2, 4.1 to 4.1.3, 4.0 to 4.0.8, 3.11 to 3.11.14, 3.9 to 3.9.21 and earlier unsupported versions.

The groups page in Moodle has a vulnerability that requires additional content sanitization to prevent XSS risk. This issue affects Moodle versions 4.2, 4.1 to 4.1.3, 4.0 to 4.0.8, and 3.11 to 3.11.14.

In Moodle before versions 3.8.2, 3.7.5, 3.6.9, and 3.5.11, users viewing the grade history report without the 'access all groups' capability were not restricted to viewing grades of users within their own groups.