Michael Hawkins

**Name of the Vulnerable Software and Affected Versions** Moodle (affected versions not specified) **Description** A flaw was found in the policy tool of Moodle, where the return URL required additional sanitizing to prevent a reflected Cross-site scripting (XSS) risk. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** moodle (affected versions not specified) **Description** A flaw was found in moodle where Matrix room membership and power levels are incorrectly applied and revoked for suspended Moodle users. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Moodle (affected versions not specified) **Description** A vulnerability exists in Moodle due to insufficient validation of the HTTP request origin in course redirect URL. This allows a remote attacker to trick a victim into visiting a specially crafted web page and perform arbitrary actions on behalf of the victim on the vulnerable website, enabling cross-site request forgery attacks. The issue arises because a user's CSRF token is unnecessarily included in the URL when being redirected to a course they have just restored. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** moodle versions prior to 3.5.2 moodle versions prior to 3.4.5 moodle versions prior to 3.3.8 **Description** The issue concerns a reflected XSS vulnerability due to insufficient filtering of the search parameter in the breadcrumb navigation provided by the Boost theme when displaying search results of a blog. This could result in reflected XSS if a user followed a malicious link containing JavaScript in the `search` parameter. **Recommendations** For versions prior to 3.5.2, update to version 3.5.2 or later. For versions prior to 3.4.5, update to version 3.4.5 or later. For versions prior to 3.3.8, update to version 3.3.8 or later.