Package Instance

Cross-Site Request Forgery (CSRF)
A CSRF attack is possible that allows attackers to change the "number of courses displayed in the course overview block" configuration setting.

Cross-site Scripting
The 'manage groups' capability did not have the 'XSS risk' flag assigned to it, but does have that access in certain places. Note that the capability is intended for use by trusted users, and is only assigned to teachers and managers by default.

Injection Vulnerability
When a quiz question bank is imported, it is possible for the question preview that is displayed to execute JavaScript that is written into the question bank.

Improper Privilege Management
Remote authenticated users can take ownership of arbitrary blogs by editing an external blog link.

Improper Input Validation
There is incorrect sanitization of attributes in forums.

Information Exposure
Students can find out email addresses of other students in the same course. Using search on the Participants page, students could search email addresses of all participants regardless of email visibility. This allows enumerating and guessing emails of other students.

Information Exposure
A flaw was found in Moodle. It is possible for the `core_course_get_categories` web service to return hidden categories, which should be omitted when fetching course categories.

Information Exposure
Various course reports allow teachers to view details about users in the groups they cannot access.

Server-Side Request Forgery (SSRF)
The mybackpack functionality allowed setting the URL of badges, when it should be restricted to the Mozilla Open Badges backpack URL. This resulted in the possibility of blind SSRF via requests made by the page.

Improper Input Validation
An issue was discovered in Moodle. By substituting URLs in portfolios, users can instantiate any class. This can also be exploited by users who are logged in as guests to create a DDoS attack.

Cross-Site Request Forgery (CSRF)
The login form is not protected by a token to prevent login cross-site request forgery.

Improper Privilege Management
An issue was discovered in Moodle. Students who submitted assignments and exported them to portfolios can download any stored Moodle file by changing the download URL.

Improper Input Validation
The size of users' private file uploads via email were not correctly checked, so their quota allowance could be exceeded.

SQL Injection
An SQL injection can occur via user preferences.

Cross-site Scripting
There is XSS in the assignment submission page.

Information Exposure
In Moodle, glossary search displays entries without checking user permissions to view them.

Information Exposure
An issue was discovered in Moodle. Students who posted on forums and exported the posts to portfolios can download any stored Moodle file by changing the download URL.

Injection Vulnerability
In Moodle, text injection can occur in email headers, potentially leading to outbound spam.

Cross-site Scripting
An issue was discovered in Moodle. An authenticated user is allowed to add HTML blocks containing scripts to their Dashboard; this is normally not a security issue because a personal dashboard is visible to this user only. Through this security vulnerability, users can move such a block to other pages where they can be viewed by other users.

Cross-site Scripting
An XSS can occur via evidence of prior learning.

Information Exposure
The `/userpix/` page did not escape users' full names, which are included as text when hovering over profile images. Note this page is not linked to by default and its access is restricted.

Improper Access Control
Unauthenticated users can trigger custom messages to admin via paypal enrol script. Paypal IPN callback script should only send error emails to admin after request origin was verified, otherwise admin email can be spammed.

Injection Vulnerability
An issue was discovered in Moodle. A Teacher creating a Calculated question can intentionally cause remote code execution on the server.

Information Exposure
Moodle has a user fullname disclosure through the user preferences page.

Exposure of Sensitive Information to an Unauthorized Actor
In Moodle 2.x and 3.x, an unenrolled user still receives event monitor notifications even though they can no longer access the course.

URL Redirection to Untrusted Site (Open Redirect)
The form to upload cohorts contained a redirect field, which was not restricted to internal URLs.

Improper Access Control
In Moodle 2.x and 3.x, the question engine allows access to files that should not be available.

Weak Password Recovery Mechanism for Forgotten Password
In Moodle, web service tokens are not invalidated when the user password is changed or forced to be changed.

Code Injection
Moodle is vulnerable to an XML import of ddwtos could lead to intentional remote code execution. When importing legacy `drag and drop into text` (ddwtos) type quiz questions, it was possible to inject and execute PHP code from within the imported questions, either intentionally or by importing questions from an untrusted source.

Exposure of Resource to Wrong Sphere
In Moodle, searching of arbitrary blogs is possible because a capability check is missing.

Cross-site Scripting
In Moodle, an XSS can occur via attachments to evidence of prior learning.

Improper Privilege Management
Course creators are able to change system default settings for courses.

Cross-site Scripting
Moodle has an XSS in the contact form on the "non-respondents" page in non-anonymous feedback.