Security announcements | Moodle.org

The question bank filter required additional sanitizing to prevent a reflected XSS risk.

Description information displayed in the site administration live log required additional sanitizing to prevent a stored XSS risk.

The drag-and-drop onto image (ddimageortext) question type required additional sanitizing to prevent a stored XSS risk.

Tags not expected to be visible to a user could still be discovered by them via the tag search page or in the tags block.

Separate Groups mode restrictions were not factored into permission checks before allowing viewing or deletion of responses in Feedback activities.

Insufficient sanitizing in the TeX notation filter resulted in an arbitrary file read risk on sites where pdfTeX is available (such as those with TeX Live installed).

Guest user sessions were given a longer timeout than authenticated users, which could result in an elevated denial of service risk.

Question bank filtering required additional sanitizing to prevent a reflected XSS risk.

In a database activity with separate groups mode enabled, users who were not in a group (and did not have permission to access all groups) could see entries from members of all groups in the activity, rather than just entries of users also not in any groups. Note: Users within groups worked as intended, only able to see entries belonging to other members of their group(s).

On sites requiring a confirmation step to update a user's email address, the token used to verify the change should only be accessible via the confirmation email, but was otherwise retrievable by the user.