Security announcements | Moodle.org

ID numbers displayed in the web service token list required additional sanitizing to prevent a stored XSS risk.

Insufficient capability checks meant message deletions were not limited to the current user.

Insufficient redirect handling made it possible to blindly bypass cURL blocked hosts/allowed ports restrictions, resulting in a blind SSRF risk. (Note: The request response was still blocked and not available to the user.)

The file repository's URL parsing required additional recursion handling to mitigate the risk of recursion denial of service.

A remote code execution risk was identified in the Shibboleth authentication plugin. (Note: Shibboleth authentication is disabled by default in Moodle.)

An SQL injection risk was identified in the library fetching a user's recent courses

An SQL injection risk was identified in the library fetching a user's enrolled courses

The H5P PHP library included with Moodle has been upgraded to the latest minor version, which includes a security fix.

The redirect URI in the LTI authorization endpoint required extra sanitizing to prevent reflected XSS and open redirect risks.

The last time a user accessed the mobile app is displayed on their profile page, but should be restricted to users with the relevant capability (site administrators by default).