Bezpečnostní oznámení | Moodle.org

The upstream TinyMCE and PrismJS libraries were upgraded, which included security fixes for multiple XSS risks. Note: These security issues did not appear to be exploitable in Moodle.

Insufficient access checks on H5P content files could result in users, including those who were not logged in, having access to view H5P content they did not have permission to access.

It was possible to bypass the login notification mechanism, so a user would not be notified if their account received a new login. This could make it easier for unauthorised users to log in without detection. Note: Valid login credentials (such as username and password) were still required.

Insufficient validation of a profile availability condition check resulted in a blind SQL injection risk being available to teachers (and other privileged users such as admins).

The XML grade import functionality (which allows setting or overwriting of student grades) did not include the necessary token to prevent a CSRF risk.

User list filters allowed managers to filter by user profile fields that they could not view on users' profiles.

Insufficient username escaping could allow a minor XSS risk if an unauthenticated user was tricked into opening a password reset link (so did not affect authenticated user sessions).

A check to validate a group belonged to a course was missing, which made it possible for teachers to add users to groups in courses that the teacher could not otherwise access.

Missing capability checks made it possible for users to trigger grade penalty recalculation without having the capability to do so.

An incorrect capability check in the AI "generate image" web service could allow users to access that feature without having the "generate image" capability.