Security announcements | Moodle.org

The upstream Symfony process module version required updating to remove a command injection risk on Windows systems.

Rendering of TeX content with mimetex in the formula editor required execution time limitations to prevent a denial of service risk.

Additional sanitizing was required on a TeX filter administration setting to prevent a remote code execution risk.

Note: The affected setting could only be accessed by site administrators, and only affected sites with the TeX notation filter enabled and ImageMagick installed on the server.

A remote code execution risk was identified in the file restore functionality.

When blind marking is enabled for an assignment, user IDs remained visible on the assignment submissions page instead of being masked.

Badges being awarded with a role performed the correct capability check, but did not verify the user had the required role to meet the award criterion.

The return URL in the policy tool required extra sanitizing to prevent a reflected XSS risk.

Forum ratings required additional permission checks to prevent users from being able to view ratings they did not have the capability to access.

Insufficient checks on a confirmation email web service made it easier to brute force password checks against known usernames.

An open redirect risk existed in the OAuth login functionality.