Security announcements | Moodle.org

Insufficient limitations on the "start page" preference made it possible to set that preference for another user. (Note: This was still limited to the pre-defined start page options)

Blog search required additional sanitizing to prevent a reflected XSS risk.

Some returnurl parameters required additional sanitizing to prevent a reflected XSS risk.

Moodle's LTI provider library did not utilise Moodle's inbuilt cURL helper, which resulted in a blind SSRF risk.

The "social" user profile field type performed insufficient escaping on some fields, resulting in a stored XSS risk.

The return URL in the policy tool required extra sanitizing to prevent a reflected XSS risk.

A user's CSRF token was unnecessarily included in the URL when being redirected to a course they have just restored.

An upstream security patch was applied to the third party VideoJS library included with Moodle, on versions affected by an XSS risk.

Insufficient limitations in some quiz web services made it possible for students to bypass sequential navigation during a quiz attempt.

The H5P activity attempts report did not filter by groups, which in separate groups mode could reveal information to non-editing teachers about attempts/users in groups they should not have access to.