CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  Take a third party risk management course for FREE
Vulnerability Feeds & WidgetsNew   

Moodle : Security Vulnerabilities

CVSS Scores Greater Than: 0   1   2   3   4   5   6   7   8   9  
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2023-28335 352 CSRF 2023-03-23 2023-03-28
0.0
 None ??? ??? ??? ??? ??? ???
The link to reset all templates of a database activity did not include the necessary token to prevent a CSRF risk.
2 CVE-2023-28334 639 2023-03-23 2023-03-28
0.0
 None ??? ??? ??? ??? ??? ???
Authenticated users were able to enumerate other users' names via the learning plans page.
3 CVE-2023-28332 79 XSS 2023-03-23 2023-03-30
0.0
 None ??? ??? ??? ??? ??? ???
If the algebra filter was enabled but not functional (eg the necessary binaries were missing from the server), it presented an XSS risk.
4 CVE-2023-28331 79 XSS 2023-03-23 2023-03-30
0.0
 None ??? ??? ??? ??? ??? ???
Content output by the database auto-linking filter required additional sanitizing to prevent an XSS risk.
5 CVE-2023-28330 2023-03-23 2023-03-30
0.0
 None ??? ??? ??? ??? ??? ???
Insufficient sanitizing in backup resulted in an arbitrary file read risk. The capability to access this feature is only available to teachers, managers and admins by default.
6 CVE-2023-28329 89 Sql 2023-03-23 2023-03-30
0.0
 None ??? ??? ??? ??? ??? ???
Insufficient validation of profile field availability condition resulted in an SQL injection risk (by default only available to teachers and managers).
7 CVE-2023-23923 2023-02-17 2023-02-28
0.0
 None ??? ??? ??? ??? ??? ???
The vulnerability was found Moodle which exists due to insufficient limitations on the "start page" preference. A remote attacker can set that preference for another user. The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.
8 CVE-2023-23922 79 Exec Code XSS 2023-02-17 2023-02-28
0.0
 None ??? ??? ??? ??? ??? ???
The vulnerability was found Moodle which exists due to insufficient sanitization of user-supplied data in blog search. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website. This flaw allows a remote attacker to perform cross-site scripting (XSS) attacks.
9 CVE-2023-23921 79 Exec Code XSS 2023-02-17 2023-02-28
0.0
 None ??? ??? ??? ??? ??? ???
The vulnerability was found Moodle which exists due to insufficient sanitization of user-supplied data in some returnurl parameters. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website. This flaw allows a remote attacker to perform cross-site scripting (XSS) attacks.
10 CVE-2023-1402 668 2023-03-23 2023-03-30
0.0
 None ??? ??? ??? ??? ??? ???
The course participation report required additional checks to prevent roles being displayed which the user did not have access to view.
11 CVE-2022-45152 918 2022-11-25 2023-02-01
0.0
 None ??? ??? ??? ??? ??? ???
A blind Server-Side Request Forgery (SSRF) vulnerability was found in Moodle. This flaw exists due to insufficient validation of user-supplied input in LTI provider library. The library does not utilise Moodle's inbuilt cURL helper, which resulted in a blind SSRF risk. An attacker can send a specially crafted HTTP request and trick the application to initiate requests to arbitrary systems. This vulnerability allows a remote attacker to perform SSRF attacks.
12 CVE-2022-45151 79 Exec Code XSS 2022-11-23 2023-01-31
0.0
 None ??? ??? ??? ??? ??? ???
The stored-XSS vulnerability was discovered in Moodle which exists due to insufficient sanitization of user-supplied data in several "social" user profile fields. An attacker could inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.
13 CVE-2022-45150 79 Exec Code XSS 2022-11-23 2023-01-31
0.0
 None ??? ??? ??? ??? ??? ???
A reflected cross-site scripting vulnerability was discovered in Moodle. This flaw exists due to insufficient sanitization of user-supplied data in policy tool. An attacker can trick the victim to open a specially crafted link that executes an arbitrary HTML and script code in user's browser in context of vulnerable website. This vulnerability may allow an attacker to perform cross-site scripting (XSS) attacks to gain access potentially sensitive information and modification of web pages.
14 CVE-2022-45149 352 CSRF 2022-11-23 2023-01-31
0.0
 None ??? ??? ??? ??? ??? ???
A vulnerability was found in Moodle which exists due to insufficient validation of the HTTP request origin in course redirect URL. A user's CSRF token was unnecessarily included in the URL when being redirected to a course they have just restored. A remote attacker can trick the victim to visit a specially crafted web page and perform arbitrary actions on behalf of the victim on the vulnerable website. This flaw allows an attacker to perform cross-site request forgery attacks.
15 CVE-2022-40316 668 2022-09-30 2022-10-04
0.0
 None ??? ??? ??? ??? ??? ???
The H5P activity attempts report did not filter by groups, which in separate groups mode could reveal information to non-editing teachers about attempts/users in groups they should not have access to.
16 CVE-2022-40315 89 Sql 2022-09-30 2022-10-04
0.0
 None ??? ??? ??? ??? ??? ???
A limited SQL injection risk was identified in the "browse list of users" site administration page.
17 CVE-2022-40314 Exec Code 2022-09-30 2022-10-04
0.0
 None ??? ??? ??? ??? ??? ???
A remote code execution risk when restoring backup files originating from Moodle 1.9 was identified.
18 CVE-2022-40313 79 XSS 2022-09-30 2022-10-04
0.0
 None ??? ??? ??? ??? ??? ???
Recursive rendering of Mustache template helpers containing user input could, in some cases, result in an XSS risk or a page failing to load.
19 CVE-2022-40208 Bypass 2023-03-24 2023-03-30
0.0
 None ??? ??? ??? ??? ??? ???
In Moodle, insufficient limitations in some quiz web services made it possible for students to bypass sequential navigation during a quiz attempt.
20 CVE-2022-39183 601 2023-01-12 2023-01-20
0.0
 None ??? ??? ??? ??? ??? ???
Moodle Plugin - SAML Auth may allow Open Redirect through unspecified vectors.
21 CVE-2022-35653 79 Exec Code XSS 2022-07-25 2022-07-28
0.0
 None ??? ??? ??? ??? ??? ???
A reflected XSS issue was identified in the LTI module of Moodle. The vulnerability exists due to insufficient sanitization of user-supplied data in the LTI module. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website to steal potentially sensitive information, change appearance of the web page, can perform phishing and drive-by-download attacks. This vulnerability does not impact authenticated users.
22 CVE-2022-35652 601 2022-07-25 2022-08-01
0.0
 None ??? ??? ??? ??? ??? ???
An open redirect issue was found in Moodle due to improper sanitization of user-supplied data in mobile auto-login feature. A remote attacker can create a link that leads to a trusted website, however, when clicked, it redirects the victims to arbitrary URL/domain. Successful exploitation of this vulnerability may allow a remote attacker to perform a phishing attack and steal potentially sensitive information.
23 CVE-2022-35651 79 Exec Code XSS 2022-07-25 2022-07-29
0.0
 None ??? ??? ??? ??? ??? ???
A stored XSS and blind SSRF vulnerability was found in Moodle, occurs due to insufficient sanitization of user-supplied data in the SCORM track details. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website to steal potentially sensitive information, change appearance of the web page, can perform phishing and drive-by-download attacks.
24 CVE-2022-35650 20 Dir. Trav. 2022-07-25 2022-08-01
0.0
 None ??? ??? ??? ??? ??? ???
The vulnerability was found in Moodle, occurs due to input validation error when importing lesson questions. This insufficient path checks results in arbitrary file read risk. This vulnerability allows a remote attacker to perform directory traversal attacks. The capability to access this feature is only available to teachers, managers and admins by default.
25 CVE-2022-35649 20 Exec Code 2022-07-25 2022-08-01
0.0
 None ??? ??? ??? ??? ??? ???
The vulnerability was found in Moodle, occurs due to improper input validation when parsing PostScript code. An omitted execution parameter results in a remote code execution risk for sites running GhostScript versions older than 9.50. Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
26 CVE-2022-30600 682 Bypass 2022-05-18 2022-06-13
7.5
 None Remote Low Not required Partial Partial Partial
A flaw was found in moodle where logic used to count failed login attempts could result in the account lockout threshold being bypassed.
27 CVE-2022-30599 89 Sql 2022-05-18 2022-06-13
7.5
 None Remote Low Not required Partial Partial Partial
A flaw was found in moodle where an SQL injection risk was identified in Badges code relating to configuring criteria.
28 CVE-2022-30598 2022-05-18 2022-06-13
4.0
 None Remote Low ??? Partial None None
A flaw was found in moodle where global search results could include author information on some activities where a user may not otherwise have access to it.
29 CVE-2022-30597 2022-05-18 2022-06-13
5.0
 None Remote Low Not required Partial None None
A flaw was found in moodle where the description user field was not hidden when being set as a hidden user field.
30 CVE-2022-30596 79 XSS 2022-05-18 2022-06-13
3.5
 None Remote Medium ??? None Partial None
A flaw was found in moodle where ID numbers displayed when bulk allocating markers to assignments required additional sanitizing to prevent a stored XSS risk.
31 CVE-2022-2986 352 CSRF 2022-10-06 2022-11-10
0.0
 None ??? ??? ??? ??? ??? ???
Enabling and disabling installed H5P libraries did not include the necessary token to prevent a CSRF risk.
32 CVE-2022-0985 287 2022-04-29 2022-05-11
4.0
 None Remote Low ??? None Partial None
Insufficient capability checks could allow users with the moodle/site:uploadusers capability to delete users, without having the necessary moodle/user:delete capability.
33 CVE-2022-0984 863 2022-04-29 2022-05-10
4.0
 None Remote Low ??? None Partial None
Users with the capability to configure badge criteria (teachers and managers by default) were able to configure course badges with profile field criteria, which should only be available for site badges.
34 CVE-2022-0983 89 Sql 2022-03-25 2022-03-30
6.5
 None Remote Low ??? Partial Partial Partial
An SQL injection risk was identified in Badges code relating to configuring criteria. Access to the relevant capability was limited to teachers and managers by default.
35 CVE-2022-0335 352 CSRF 2022-01-25 2022-02-01
6.8
 None Remote Medium Not required Partial Partial Partial
A flaw was found in Moodle in versions 3.11 to 3.11.4, 3.10 to 3.10.8, 3.9 to 3.9.11 and earlier unsupported versions. The "delete badge alignment" functionality did not include the necessary token check to prevent a CSRF risk.
36 CVE-2022-0334 668 2022-01-25 2022-02-01
4.0
 None Remote Low ??? Partial None None
A flaw was found in Moodle in versions 3.11 to 3.11.4, 3.10 to 3.10.8, 3.9 to 3.9.11 and earlier unsupported versions. Insufficient capability checks could lead to users accessing their grade report for courses where they did not have the required gradereport/user:view capability.
37 CVE-2022-0333 863 2022-01-25 2022-02-01
5.5
 None Remote Low ??? Partial Partial None
A flaw was found in Moodle in versions 3.11 to 3.11.4, 3.10 to 3.10.8, 3.9 to 3.9.11 and earlier unsupported versions. The calendar:manageentries capability allowed managers to access or modify any calendar event, but should have been restricted from accessing user level events.
38 CVE-2022-0332 89 Sql 2022-01-25 2022-02-01
7.5
 None Remote Low Not required Partial Partial Partial
A flaw was found in Moodle in versions 3.11 to 3.11.4. An SQL injection risk was identified in the h5p activity web service responsible for fetching user attempt data.
39 CVE-2021-43560 668 2021-11-22 2022-06-14
5.0
 None Remote Low Not required Partial None None
A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions. Insufficient capability checks made it possible to fetch other users' calendar action events.
40 CVE-2021-43559 352 CSRF 2021-11-22 2022-06-14
6.8
 None Remote Medium Not required Partial Partial Partial
A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions. The "delete related badge" functionality did not include the necessary token check to prevent a CSRF risk.
41 CVE-2021-43558 79 XSS 2021-11-22 2022-06-14
4.3
 None Remote Medium Not required None Partial None
A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions. A URL parameter in the filetype site administrator tool required extra sanitizing to prevent a reflected XSS risk.
42 CVE-2021-40695 2022-09-29 2022-10-03
0.0
 None ??? ??? ??? ??? ??? ???
It was possible for a student to view their quiz grade before it had been released, using a quiz web service.
43 CVE-2021-40694 116 2022-09-29 2022-10-03
0.0
 None ??? ??? ??? ??? ??? ???
Insufficient escaping of the LaTeX preamble made it possible for site administrators to read files available to the HTTP server system account.
44 CVE-2021-40693 287 Bypass 2022-09-29 2022-10-03
0.0
 None ??? ??? ??? ??? ??? ???
An authentication bypass risk was identified in the external database authentication functionality, due to a type juggling vulnerability.
45 CVE-2021-40692 863 2022-09-29 2022-10-03
0.0
 None ??? ??? ??? ??? ??? ???
Insufficient capability checks made it possible for teachers to download users outside of their courses.
46 CVE-2021-40691 2022-09-29 2022-10-03
0.0
 None ??? ??? ??? ??? ??? ???
A session hijack risk was identified in the Shibboleth authentication plugin.
47 CVE-2021-36568 79 XSS 2022-09-13 2022-09-30
0.0
 None ??? ??? ??? ??? ??? ???
In certain Moodle products after creating a course, it is possible to add in a arbitrary "Topic" a resource, in this case a "Database" with the type "Text" where its values "Field name" and "Field description" are vulnerable to Cross Site Scripting Stored(XSS). This affects Moodle 3.11 and Moodle 3.10.4 and Moodle 3.9.7.
48 CVE-2021-36403 2023-03-06 2023-03-13
0.0
 None ??? ??? ??? ??? ??? ???
In Moodle, in some circumstances, email notifications of messages could have the link back to the original message hidden by HTML, which may pose a phishing risk.
49 CVE-2021-36402 2023-03-06 2023-03-13
0.0
 None ??? ??? ??? ??? ??? ???
In Moodle, Users' names required additional sanitizing in the account confirmation email, to prevent a self-registration phishing risk.
50 CVE-2021-36401 79 XSS 2023-03-06 2023-03-13
0.0
 None ??? ??? ??? ??? ??? ???
In Moodle, ID numbers exported in HTML data formats required additional sanitizing to prevent a local stored XSS risk.
Total number of vulnerabilities : 498   Page : 1 (This Page)2 3 4 5 6 7 8 9 10
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.