Sam Hemelryk

**Name of the Vulnerable Software and Affected Versions** Moodle versions 3.5 through 3.5.7 Moodle versions 3.6 through 3.6.5 Moodle versions 3.7 through 3.7.1 **Description** A vulnerability was found where javaScript injection was possible in some Mustache templates via recursive rendering from contexts. This occurred because Mustache helper tags included in template contexts were not being escaped before the context was injected into another Mustache helper, which could result in script injection in some templates. **Recommendations** For versions 3.5 through 3.5.7, update to a version later than 3.5.7 to resolve the issue. For versions 3.6 through 3.6.5, update to a version later than 3.6.5 to resolve the issue. For versions 3.7 through 3.7.1, update to a version later than 3.7.1 to resolve the issue. As a temporary workaround, consider restricting the use of recursive rendering in Mustache templates to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Moodle versions prior to 2.5.9 Moodle versions 2.6.x before 2.6.9 Moodle versions 2.7.x before 2.7.6 Moodle versions 2.8.x before 2.8.4 **Description** The issue is related to errors in the code of the lib/moodlelib.php component in the Moodle learning management system. Exploitation of this issue may allow a remote attacker to gain access to protected information. The vulnerability is exploited when the theme uses the blocks-regions feature, and the course state is established at an incorrect point in the login-validation process, allowing remote attackers to obtain sensitive course information. **Recommendations** For Moodle versions prior to 2.5.9, update to version 2.5.9 or later. For Moodle versions 2.6.x before 2.6.9, update to version 2.6.9 or later. For Moodle versions 2.7.x before 2.7.6, update to version 2.7.6 or later. For Moodle versions 2.8.x before 2.8.4, update to version 2.8.4 or later.

**Name of the Vulnerable Software and Affected Versions** Moodle versions 2.0.x through 2.0.8 Moodle versions 2.1.x through 2.1.5 Moodle versions 2.2.x through 2.2.2 **Description** A cross-site scripting (XSS) issue exists in the Wiki subsystem, allowing remote authenticated users to inject arbitrary web script or HTML via a crafted string inserted into a page title. **Recommendations** For Moodle versions 2.0.x through 2.0.8, update to version 2.0.9 or later. For Moodle versions 2.1.x through 2.1.5, update to version 2.1.6 or later. For Moodle versions 2.2.x through 2.2.2, update to version 2.2.3 or later.

**Name of the Vulnerable Software and Affected Versions** Moodle versions 2.0.0 through 2.0.2 **Description** The issue allows remote authenticated users to cause a denial of service by creating invalid database records through a series of crafted ratings operations. **Recommendations** For Moodle versions 2.0.0 through 2.0.2, update to version 2.0.3 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Moodle versions 2.0.0 through 2.0.2 **Description** The issue allows remote authenticated users to cause a denial of service by creating invalid database records through a series of crafted comments operations. **Recommendations** For Moodle versions 2.0.0 through 2.0.2, update to version 2.0.3 or later to resolve the issue.