Security announcements | Moodle.org

Hi everyone,

We have been made aware of a critical security vulnerability in the third-party Configurable Reports plugin (block_configurable_reports). The maintainer has prepared a fix and submitted an updated version to Moodle Marketplace, so a patched version of the plugin will be available shortly.

If you have the Configurable Reports plugin installed, we strongly recommend updating to the latest version as soon as it is available, or disabling/uninstalling that plugin until you are able to perform the update. If you do not have the Configurable Reports plugin installed, no action is required.

Kind regards,

Mick Hawkins

Product Manager - Community Contributions

Moodle HQ

The upstream TinyMCE and PrismJS libraries were upgraded, which included security fixes for multiple XSS risks. Note: These security issues did not appear to be exploitable in Moodle.

Insufficient access checks on H5P content files could result in users, including those who were not logged in, having access to view H5P content they did not have permission to access.

It was possible to bypass the login notification mechanism, so a user would not be notified if their account received a new login. This could make it easier for unauthorised users to log in without detection. Note: Valid login credentials (such as username and password) were still required.

Insufficient validation of a profile availability condition check resulted in a blind SQL injection risk being available to teachers (and other privileged users such as admins).

The XML grade import functionality (which allows setting or overwriting of student grades) did not include the necessary token to prevent a CSRF risk.

User list filters allowed managers to filter by user profile fields that they could not view on users' profiles.

Insufficient username escaping could allow a minor XSS risk if an unauthenticated user was tricked into opening a password reset link (so did not affect authenticated user sessions).

A check to validate a group belonged to a course was missing, which made it possible for teachers to add users to groups in courses that the teacher could not otherwise access.

Missing capability checks made it possible for users to trigger grade penalty recalculation without having the capability to do so.