Matangazo ya usalama | Moodle.org

Insufficient capability checks could lead to users with the ability to course restore adding additional capabilities to roles within that course.

Users' enrolment capabilities were not being sufficiently checked when they restored into an existing course, which could lead to them unenrolling users without having permission to do so.

It was possible to include JavaScript in a book's chapter title, which was not escaped on the "Add new chapter" page.

Note: By default this functionality is only available to trusted users (such as teachers), but has been included as a security issue as a precaution, since it was not sanitized on sites with forceclean enabled.

The decompressed size of zip files was not checked against available user quota before unzipping them, which could lead to a denial of service risk.

Users with "Log in as" capability in a course context (typically, course managers) may gain access to some site administration capabilities by "logging in as" a System manager.

The filter in the tag manager required extra sanitizing to prevent a reflected XSS risk.

The moodlenetprofile user profile field required extra sanitizing to prevent a stored XSS risk.

yui_combo needed to limit the amount of files it can load to help mitigate the risk of denial of service.

Teachers of a course were able to assign themselves the manager role within that course.

The filter in the admin task log required extra sanitizing to prevent a reflected XSS risk.