Security announcements | Moodle.org

The Feedback activity module's import functionality required additional sanitizing to prevent a reflected XSS risk.

The user profile page reset action did not include the necessary token to prevent a CSRF risk.

The setting for users to set their own homepage preference did not include the necessary token to prevent a CSRF risk.

Additional checks were required to ensure users with the capability to delete comments can only do so in the contexts where they have the permission.

Missing group access checks in some grade web services could allow a user to access grade and user information for students in groups they did not have permission to view.

A remote code execution risk was identified in the admin presets import feature. Note: This feature is only available to site administrators.

An arbitrary file read risk was identified in the backup restore functionality.

A flaw in email-based multi-factor authentication made it possible for a user to bypass another user's MFA token check if using the email factor. Note: Valid login credentials (such as username and password) were still required to log into the account.

An arbitrary file read risk was identified in the Database Activity module's import feature.

Hi all,

We have been made aware of a serious security vulnerability in the third-party Socialwall course format plugin (format_socialwall). As the plugin is no longer actively maintained, no fix is forthcoming, and we consider it unsafe to use.

If you have the Socialwall plugin installed, we recommend disabling or uninstalling it as soon as possible. We have also removed that plugin from our plugins directory. If you do not have the Socialwall course format plugin installed, no action is required.

We would like to thank gr3mlin for responsibly disclosing this vulnerability to us via our security submission form, after they were unable to reach the plugin maintainer directly (we were able to subsequently reach the maintainer and confirm the plugin is no longer in active development).

Are you interested in taking over maintenance of Socialwall?

If your site is using this plugin and you have the capacity to take on its maintenance (including fixing the vulnerability), we'd love to hear from you - please reply to this thread or contact me directly.