CVE-2023-28329

Insufficient validation of profile field availability condition resulted in an SQL injection risk (by default only available to teachers and managers).

CVE-2023-28336

Insufficient filtering of grade report history made it possible for teachers to access the names of users they could not otherwise access.

CVE-2023-28333

The Mustache pix helper contained a potential Mustache injection risk if combined with user input (note: This did not appear to be implemented/exploitable anywhere in the core Moodle LMS).

CVE-2023-28331

Content output by the database auto-linking filter required additional sanitizing to prevent an XSS risk.

CVE-2023-28334

Authenticated users were able to enumerate other users' names via the learning plans page.

CVE-2023-1402

The course participation report required additional checks to prevent roles being displayed which the user did not have access to view.

CVE-2023-28332

If the algebra filter was enabled but not functional (eg the necessary binaries were missing from the server), it presented an XSS risk.

CVE-2023-28330

Insufficient sanitizing in backup resulted in an arbitrary file read risk. The capability to access this feature is only available to teachers, managers and admins by default.

CVE-2023-28335

The link to reset all templates of a database activity did not include the necessary token to prevent a CSRF risk.