Security announcements | Moodle.org

An SQL injection risk was identified in Badges code relating to configuring criteria. Access to the relevant capability was limited to teachers and managers by default.

NOTE: Please pay particular attention to this fix. Information was recently released online about this vulnerability by third parties, so please upgrade or patch as soon as you are able to. We prepared the patch for this as soon as we became aware of the issue, to ensure a fix was available for this release.

It is important to reiterate that this vulnerability is only accessible by teachers/managers/admins by default, because it requires the capability to add and enable badge criteria. As mentioned in the workaround listed below, this can be mitigated (on all non-admin users) by removing the relevant capability until the patch is applied.

The "delete badge alignment" functionality did not include the necessary token check to prevent a CSRF risk.

Insufficient capability checks could lead to users accessing their grade report for courses where they did not have the required gradereport/user:view capability.

The calendar:manageentries capability allowed managers to access or modify any calendar event, but should have been restricted from accessing user level events.

An SQL injection risk was identified in the h5p activity web service responsible for fetching user attempt data.

Insufficient capability checks made it possible to fetch other users' calendar action events.

The "delete related badge" functionality did not include the necessary token check to prevent a CSRF risk.

A URL parameter in the filetype site administrator tool required extra sanitizing to prevent a reflected XSS risk.

The upstream Moodle machine learning backend and its reference in /lib/mlbackend/python/classes/processor.php were upgraded, which includes some security updates.

Please note: If you are using Moodle Analytics, an upgrade to the mlbackend is required. See the Analytics settings documentation for more information about required versions and how to upgrade.

A remote code execution risk when restoring backup files was identified.