Moodle Chile Servicios Moodle en Chile

It was possible to create a SCORM package in such a way that when added to a course, it could be interacted with via web services in order to achieve remote code execution.

Users viewing the grade history report without the 'access all groups' capability were not restricted to viewing grades of users within their own groups.

X-Forwarded-For headers could be used to spoof a user's IP, in order to bypass remote address checks.

PATCH NOTE: For user IPs to be checked (and logged) accurately after this patch is applied, sites using multiple levels of reverse proxies/balancers that append to the X-Forwarded-For header will need to configure the new "...

Insufficient input escaping was applied to the PHP unit webrunner admin tool.

NOTE: It is important to note that this update is only flagged as a precautionary measure, as it may provide limited CLI access to Moodle site admins. This may be considered a security risk in circumstances where admins do not ordinarily have...

Messages required extra sanitizing before updating the conversation overview, to prevent the risk of stored XSS.

When a cohort role assignment was removed, the associated capabilites were not being revoked (where applicable).

OAuth 2 providers who do not verify users' email address changes require additional verification during sign-up to reduce the risk of account compromise.

User emails required additional sanitizing to prevent blind XSS risk on some pages.

An open redirect existed in the Lesson edit page.

Tokens used to fetch inline attachments in email notifications were not disabled when a user's account was no longer active. Note: to access files, a user would need to know the file path, and their token.