Moodle
Page 2 of 7 — Moodle CVEs from a corpus of 633, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-29374 | Medium | 6.1 | 2024-03-21 | A Cross-Site Scripting (XSS) vulnerability exists in the way MOODLE 3.10.9 handles user input within the "GET /?lang=" URL parameter. |
CVE-2024-25983 | Low | 3.5 | 2024-02-19 | Insufficient checks in a web service made it possible to add comments to the comments block on another user's dashboard when it was not otherwise available (e… |
CVE-2024-25982 | Medium | 4.3 | 2024-02-19 | The link to update all installed language packs did not include the necessary token to prevent a CSRF risk. |
CVE-2024-25981 | Medium | 4.3 | 2024-02-19 | Separate Groups mode restrictions were not honored when performing a forum export, which would export forum data for all groups. By default this only provided… |
CVE-2024-25980 | Medium | 4.3 | 2024-02-19 | Separate Groups mode restrictions were not honored in the H5P attempts report, which would display users from other groups. By default this only provided addit… |
CVE-2024-25979 | Medium | 5.3 | 2024-02-19 | The URL parameters accepted by forum search were not limited to the allowed parameters. |
CVE-2024-25978 | High | 7.5 | 2024-02-19 | Insufficient file size checks resulted in a denial of service risk in the file picker's unzip functionality. |
CVE-2024-1439 | Medium | 6.5 | 2024-02-12 | Inadequate access control in Moodle LMS. This vulnerability could allow a local user with a student role to create arbitrary events intended for users with hig… |
CVE-2023-5543 | Low | 3.3 | 2023-11-09 | When duplicating a BigBlueButton activity, the original meeting ID was also duplicated instead of using a new ID for the new activity. This could provide unint… |
CVE-2023-5551 | Low | 3.3 | 2023-11-09 | Separate Groups mode restrictions were not honoured in the forum summary report, which would display users from other groups. |
CVE-2023-5550 | Medium | 6.5 | 2023-11-09 | In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user who also has direct access to the web server… |
CVE-2023-5549 | Low | 3.3 | 2023-11-09 | Insufficient web service capability checks made it possible to move categories a user had permission to manage, to a parent category they did not have the capa… |
CVE-2023-5548 | Low | 3.3 | 2023-11-09 | Stronger revision number limitations were required on file serving endpoints to improve cache poisoning protection. |
CVE-2023-5547 | Low | 3.3 | 2023-11-09 | The course upload preview contained an XSS risk for users uploading unsafe data. |
CVE-2023-5546 | Medium | 4.3 | 2023-11-09 | ID numbers displayed in the quiz grading report required additional sanitizing to prevent a stored XSS risk. |
CVE-2023-5545 | Low | 3.3 | 2023-11-09 | H5P metadata automatically populated the author with the user's username, which could be sensitive information. |
CVE-2023-5544 | Medium | 6.5 | 2023-11-09 | Wiki comments required additional sanitizing and access restrictions to prevent a stored XSS risk and potential IDOR risk. |
CVE-2023-5542 | Low | 3.3 | 2023-11-09 | Students in "Only see own membership" groups could see other students in the group, which should be hidden. |
CVE-2023-5541 | Low | 3.3 | 2023-11-09 | The CSV grade import method contained an XSS risk for users importing the spreadsheet, if it contained unsafe content. |
CVE-2023-5540 | Medium | 4.7 | 2023-11-09 | A remote code execution risk was identified in the IMSCP activity. By default this was only available to teachers and managers. |
CVE-2023-5539 | Medium | 4.7 | 2023-11-09 | A remote code execution risk was identified in the Lesson activity. By default this was only available to teachers and managers. |
CVE-2023-46858 | Medium | 5.4 | 2023-10-29 | Moodle 4.3 allows /grade/report/grader/index.php?searchvalue= reflected XSS when logged in as a teacher. NOTE: the Moodle Security FAQ link states "Some forms… |
CVE-2023-35133 | High | 7.5 | 2023-06-22 | An issue in the logic used to check 0.0.0.0 against the cURL blocked hosts lists resulted in an SSRF risk. This flaw affects Moodle versions 4.2, 4.1 to 4.1.3… |
CVE-2023-35132 | Medium | 6.3 | 2023-06-22 | A limited SQL injection risk was identified on the Mnet SSO access control page. This flaw affects Moodle versions 4.2, 4.1 to 4.1.3, 4.0 to 4.0.8, 3.11 to 3.1… |
CVE-2023-35131 | Medium | 6.1 | 2023-06-22 | Content on the groups page required additional sanitizing to prevent an XSS risk. This flaw affects Moodle versions 4.2, 4.1 to 4.1.3, 4.0 to 4.0.8 and 3.11 to… |
CVE-2021-27131 | Medium | 5.4 | 2023-05-16 | Moodle 3.10.1 is vulnerable to persistent/stored cross-site scripting (XSS) due to the improper input sanitization on the "Additional HTML Section" via "Header… |
CVE-2023-30944 | Medium | 5.6 | 2023-05-02 | The vulnerability was found Moodle which exists due to insufficient sanitization of user-supplied data in external Wiki method for listing pages. A remote atta… |
CVE-2023-30943 | Medium | 6.5 | 2023-05-02 | The vulnerability was found Moodle which exists because the application allows a user to control path of the older to create in TinyMCE loaders. A remote user… |
CVE-2022-40208 | Medium | 4.3 | 2023-03-24 | In Moodle, insufficient limitations in some quiz web services made it possible for students to bypass sequential navigation during a quiz attempt. |
CVE-2023-28336 | Medium | 4.3 | 2023-03-23 | Insufficient filtering of grade report history made it possible for teachers to access the names of users they could not otherwise access. |
CVE-2023-28335 | High | 8.8 | 2023-03-23 | The link to reset all templates of a database activity did not include the necessary token to prevent a CSRF risk. |
CVE-2023-28334 | Medium | 4.3 | 2023-03-23 | Authenticated users were able to enumerate other users' names via the learning plans page. |
CVE-2023-28333 | Critical | 9.8 | 2023-03-23 | The Mustache pix helper contained a potential Mustache injection risk if combined with user input (note: This did not appear to be implemented/exploitable anyw… |
CVE-2023-28332 | Medium | 6.1 | 2023-03-23 | If the algebra filter was enabled but not functional (eg the necessary binaries were missing from the server), it presented an XSS risk. |
CVE-2023-28331 | Medium | 6.1 | 2023-03-23 | Content output by the database auto-linking filter required additional sanitizing to prevent an XSS risk. |
CVE-2023-28330 | Medium | 6.5 | 2023-03-23 | Insufficient sanitizing in backup resulted in an arbitrary file read risk. The capability to access this feature is only available to teachers, managers and ad… |
CVE-2023-28329 | High | 8.8 | 2023-03-23 | Insufficient validation of profile field availability condition resulted in an SQL injection risk (by default only available to teachers and managers). |
CVE-2023-1402 | Medium | 4.3 | 2023-03-23 | The course participation report required additional checks to prevent roles being displayed which the user did not have access to view. |
CVE-2021-36403 | Medium | 5.3 | 2023-03-06 | In Moodle, in some circumstances, email notifications of messages could have the link back to the original message hidden by HTML, which may pose a phishing ri… |
CVE-2021-36402 | Medium | 5.3 | 2023-03-06 | In Moodle, Users' names required additional sanitizing in the account confirmation email, to prevent a self-registration phishing risk. |
CVE-2021-36401 | Medium | 4.8 | 2023-03-06 | In Moodle, ID numbers exported in HTML data formats required additional sanitizing to prevent a local stored XSS risk. |
CVE-2021-36400 | Medium | 5.3 | 2023-03-06 | In Moodle, insufficient capability checks made it possible to remove other users' calendar URL subscriptions. |
CVE-2021-36399 | Medium | 5.4 | 2023-03-06 | In Moodle, ID numbers displayed in the quiz override screens required additional sanitizing to prevent a stored XSS risk. |
CVE-2021-36398 | Medium | 5.4 | 2023-03-06 | In moodle, ID numbers displayed in the web service token list required additional sanitizing to prevent a stored XSS risk. |
CVE-2021-36397 | Medium | 5.3 | 2023-03-06 | In Moodle, insufficient capability checks meant message deletions were not limited to the current user. |
CVE-2021-36396 | High | 7.5 | 2023-03-06 | In Moodle, insufficient redirect handling made it possible to blindly bypass cURL blocked hosts/allowed ports restrictions, resulting in a blind SSRF risk. |
CVE-2021-36395 | High | 7.5 | 2023-03-06 | In Moodle, the file repository's URL parsing required additional recursion handling to mitigate the risk of recursion denial of service. |
CVE-2021-36394 | Critical | 9.8 | 2023-03-06 | In Moodle, a remote code execution risk was identified in the Shibboleth authentication plugin. |
CVE-2021-36393 | Critical | 9.8 | 2023-03-06 | In Moodle, an SQL injection risk was identified in the library fetching a user's recent courses. |
CVE-2021-36392 | Critical | 9.8 | 2023-03-06 | In Moodle, an SQL injection risk was identified in the library fetching a user's enrolled courses. |
CVE-2023-23923 | High | 8.2 | 2023-02-17 | The vulnerability was found Moodle which exists due to insufficient limitations on the "start page" preference. A remote attacker can set that preference for a… |
CVE-2023-23922 | Medium | 6.1 | 2023-02-17 | The vulnerability was found Moodle which exists due to insufficient sanitization of user-supplied data in blog search. A remote attacker can trick the victim t… |
CVE-2023-23921 | Medium | 6.1 | 2023-02-17 | The vulnerability was found Moodle which exists due to insufficient sanitization of user-supplied data in some returnurl parameters. A remote attacker can tric… |
CVE-2022-39183 | Medium | 6.5 | 2023-01-12 | Moodle Plugin - SAML Auth may allow Open Redirect through unspecified vectors. |
CVE-2022-45152 | Critical | 9.1 | 2022-11-25 | A blind Server-Side Request Forgery (SSRF) vulnerability was found in Moodle. This flaw exists due to insufficient validation of user-supplied input in LTI pro… |
CVE-2022-45151 | Medium | 5.4 | 2022-11-23 | The stored-XSS vulnerability was discovered in Moodle which exists due to insufficient sanitization of user-supplied data in several "social" user profile fiel… |
CVE-2022-45150 | Medium | 6.1 | 2022-11-23 | A reflected cross-site scripting vulnerability was discovered in Moodle. This flaw exists due to insufficient sanitization of user-supplied data in policy tool… |
CVE-2022-45149 | Medium | 5.4 | 2022-11-23 | A vulnerability was found in Moodle which exists due to insufficient validation of the HTTP request origin in course redirect URL. A user's CSRF token was unne… |
CVE-2022-2986 | High | 8.8 | 2022-10-06 | Enabling and disabling installed H5P libraries did not include the necessary token to prevent a CSRF risk. |
CVE-2022-40316 | Medium | 4.3 | 2022-09-30 | The H5P activity attempts report did not filter by groups, which in separate groups mode could reveal information to non-editing teachers about attempts/users… |
CVE-2022-40315 | Critical | 9.8 | 2022-09-30 | A limited SQL injection risk was identified in the "browse list of users" site administration page. |
CVE-2022-40314 | Critical | 9.8 | 2022-09-30 | A remote code execution risk when restoring backup files originating from Moodle 1.9 was identified. |
CVE-2022-40313 | High | 7.1 | 2022-09-30 | Recursive rendering of Mustache template helpers containing user input could, in some cases, result in an XSS risk or a page failing to load. |
CVE-2021-40695 | Medium | 4.3 | 2022-09-29 | It was possible for a student to view their quiz grade before it had been released, using a quiz web service. |
CVE-2021-40694 | Medium | 4.9 | 2022-09-29 | Insufficient escaping of the LaTeX preamble made it possible for site administrators to read files available to the HTTP server system account. |
CVE-2021-40693 | Medium | 6.5 | 2022-09-29 | An authentication bypass risk was identified in the external database authentication functionality, due to a type juggling vulnerability. |
CVE-2021-40692 | Medium | 4.3 | 2022-09-29 | Insufficient capability checks made it possible for teachers to download users outside of their courses. |
CVE-2021-40691 | Medium | 4.3 | 2022-09-29 | A session hijack risk was identified in the Shibboleth authentication plugin. |
CVE-2021-36568 | Medium | 5.4 | 2022-09-13 | In certain Moodle products after creating a course, it is possible to add in a arbitrary "Topic" a resource, in this case a "Database" with the type "Text" whe… |
CVE-2020-1756 | High | 7.2 | 2022-08-16 | In Moodle before 3.8.2, 3.7.5, 3.6.9 and 3.5.11, insufficient input escaping was applied to the PHP unit webrunner admin tool. |
CVE-2020-1755 | Medium | 5.3 | 2022-08-16 | In Moodle before 3.8.2, 3.7.5, 3.6.9 and 3.5.11, X-Forwarded-For headers could be used to spoof a user's IP, in order to bypass remote address checks. |
CVE-2020-14322 | High | 7.5 | 2022-08-16 | In Moodle before 3.9.1, 3.8.4, 3.7.7 and 3.5.13, yui_combo needed to limit the amount of files it can load to help mitigate the risk of denial of service. |
CVE-2020-14321 | High | 8.8 | 2022-08-16 | In Moodle before 3.9.1, 3.8.4, 3.7.7 and 3.5.13, teachers of a course were able to assign themselves the manager role within that course. |
CVE-2020-14320 | Medium | 6.1 | 2022-08-16 | In Moodle before 3.9.1, 3.8.4 and 3.7.7, the filter in the admin task log required extra sanitizing to prevent a reflected XSS risk. |
CVE-2020-1754 | Medium | 4.3 | 2022-08-05 | In Moodle before 3.8.2, 3.7.5, 3.6.9 and 3.5.11, users viewing the grade history report without the 'access all groups' capability were not restricted to viewi… |
CVE-2020-1691 | Medium | 5.4 | 2022-08-05 | In Moodle 3.8, messages required extra sanitizing before updating the conversation overview, to prevent the risk of stored cross-site scripting. |
CVE-2022-35653 | Medium | 6.1 | 2022-07-25 | A reflected XSS issue was identified in the LTI module of Moodle. The vulnerability exists due to insufficient sanitization of user-supplied data in the LTI mo… |
CVE-2022-35652 | Medium | 6.1 | 2022-07-25 | An open redirect issue was found in Moodle due to improper sanitization of user-supplied data in mobile auto-login feature. A remote attacker can create a link… |
CVE-2022-35651 | Medium | 6.1 | 2022-07-25 | A stored XSS and blind SSRF vulnerability was found in Moodle, occurs due to insufficient sanitization of user-supplied data in the SCORM track details. A remo… |
CVE-2022-35650 | High | 7.5 | 2022-07-25 | The vulnerability was found in Moodle, occurs due to input validation error when importing lesson questions. This insufficient path checks results in arbitrary… |
CVE-2022-35649 | Critical | 9.8 | 2022-07-25 | The vulnerability was found in Moodle, occurs due to improper input validation when parsing PostScript code. An omitted execution parameter results in a remote… |
CVE-2022-30600 | Critical | 9.8 | 2022-05-18 | A flaw was found in moodle where logic used to count failed login attempts could result in the account lockout threshold being bypassed. |
CVE-2022-30599 | Critical | 9.8 | 2022-05-18 | A flaw was found in moodle where an SQL injection risk was identified in Badges code relating to configuring criteria. |
CVE-2022-30598 | Medium | 4.3 | 2022-05-18 | A flaw was found in moodle where global search results could include author information on some activities where a user may not otherwise have access to it. |
CVE-2022-30597 | Medium | 5.3 | 2022-05-18 | A flaw was found in moodle where the description user field was not hidden when being set as a hidden user field. |
CVE-2022-30596 | Medium | 5.4 | 2022-05-18 | A flaw was found in moodle where ID numbers displayed when bulk allocating markers to assignments required additional sanitizing to prevent a stored XSS risk. |
CVE-2022-0984 | Medium | 4.3 | 2022-04-29 | Users with the capability to configure badge criteria (teachers and managers by default) were able to configure course badges with profile field criteria, whic… |
CVE-2022-0985 | Medium | 4.3 | 2022-04-29 | Insufficient capability checks could allow users with the moodle/site:uploadusers capability to delete users, without having the necessary moodle/user:delete c… |
CVE-2022-0983 | High | 8.8 | 2022-03-25 | An SQL injection risk was identified in Badges code relating to configuring criteria. Access to the relevant capability was limited to teachers and managers by… |
CVE-2021-32478 | Medium | 6.1 | 2022-03-11 | The redirect URI in the LTI authorization endpoint required extra sanitizing to prevent reflected XSS and open redirect risks. Moodle versions 3.10 to 3.10.3… |
CVE-2021-32477 | Medium | 4.3 | 2022-03-11 | The last time a user accessed the mobile app is displayed on their profile page, but should be restricted to users with the relevant capability (site administr… |
CVE-2021-32476 | High | 7.5 | 2022-03-11 | A denial-of-service risk was identified in the draft files area, due to it not respecting user file upload limits. Moodle versions 3.10 to 3.10.3, 3.9 to 3.9.6… |
CVE-2021-32475 | Medium | 5.4 | 2022-03-11 | ID numbers displayed in the quiz grading report required additional sanitizing to prevent a stored XSS risk. Moodle 3.10 to 3.10.3, 3.9 to 3.9.6, 3.8 to 3.8.8… |
CVE-2021-32474 | High | 7.2 | 2022-03-11 | An SQL injection risk existed on sites with MNet enabled and configured, via an XML-RPC call from the connected peer host. Note that this required site adminis… |
CVE-2021-32473 | Medium | 5.3 | 2022-03-11 | It was possible for a student to view their quiz grade before it had been released, using a quiz web service. Moodle 3.10 to 3.10.3, 3.9 to 3.9.6, 3.8 to 3.8.8… |
CVE-2021-32472 | Medium | 4.3 | 2022-03-11 | Teachers exporting a forum in CSV format could receive a CSV of forums from all courses in some circumstances. Moodle versions 3.10 to 3.10.3, 3.9 to 3.9.6 and… |
CVE-2022-0335 | High | 8.8 | 2022-01-25 | A flaw was found in Moodle in versions 3.11 to 3.11.4, 3.10 to 3.10.8, 3.9 to 3.9.11 and earlier unsupported versions. The "delete badge alignment" functionali… |
CVE-2022-0334 | Medium | 4.3 | 2022-01-25 | A flaw was found in Moodle in versions 3.11 to 3.11.4, 3.10 to 3.10.8, 3.9 to 3.9.11 and earlier unsupported versions. Insufficient capability checks could lea… |
CVE-2022-0333 | Low | 3.8 | 2022-01-25 | A flaw was found in Moodle in versions 3.11 to 3.11.4, 3.10 to 3.10.8, 3.9 to 3.9.11 and earlier unsupported versions. The calendar:manageentries capability al… |
CVE-2022-0332 | Critical | 9.8 | 2022-01-25 | A flaw was found in Moodle in versions 3.11 to 3.11.4. An SQL injection risk was identified in the h5p activity web service responsible for fetching user attem… |