Yuriy Dyachenko

The issue allows an authenticated attacker with privileges to modify data source configurations to read arbitrary files. This can be exploited by an attacker who has the necessary permissions to access and modify the data source configurations.

A reflected XSS is possible from some fatal error messages. This issue affects various versions of Moodle, allowing for potential exploitation through specific error messages.

The issue allows remote attackers to create valid sessions without using session validators, potentially leading to unauthorized access.