Security announcements | Moodle.org

Insufficient Moodle app token isolation made it possible for a Moodle site being logged into the app to access secure-storage tokens for other Moodle sites the user already had configured in their Moodle mobile app. This could result in compromise of the user’s web service token if, for example, they were tricked into logging into a malicious Moodle site in the Moodle app via a deep-link.

The security issue affects the official Moodle mobile app and apps built using its codebase. Pre-configured apps that only connect to a set list of sites, such as official Branded Moodle Apps, are not affected by this issue.

To avoid leaving your mobile app users vulnerable, we highly recommend asking your users to upgrade to the latest available Moodle mobile app version, and for you to make the following configuration change on your Moodle site: Open “Site administration” > “General” > “Mobile app authentication” and set the “Minimum app version required” setting to 5.2.1.

The report builder fragment output callbacks did not verify that the requesting user had the required capability to access the requested report, potentially allowing users to retrieve report data beyond their permitted access.

User profile descriptions for authenticated users posed a denial of service risk due to the absence of a defined maximum length.

A blind SSRF risk was identified in the MNet peers management functionality, due to missing validation of peer hostnames against the cURL blocked hosts configuration. Note: This feature is only available to site administrators.

Insufficient capability checks in the Assignment module's marker allocation functionality allowed users without the required capability to allocate markers to submissions.

The regrade action in the quiz overview report did not include the necessary token to prevent a CSRF risk.

Capability checks were missing from course assistance AI placement web services, which could allow users to make requests to those AI course assistance web services without having the relevant capabilities (if those features are enabled).

The quiz feature to add section headings did not include the necessary token to prevent a CSRF risk.

The actions to enable and disable group messaging did not include the necessary token to prevent a CSRF risk.

The grade item ID number editing functionality did not include the necessary token to prevent a CSRF risk and also lacked sufficient output sanitizing to prevent an XSS risk.