GHSA-cw24-f6fq-7j9v
Moodle allows teachers to evade trusttext config when restoring glossary entries
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Packagist | moodle/moodle | >= 4.5.0-beta, < 4.5.2 | 4.5.2 |
| Packagist | moodle/moodle | >= 4.4.0-beta, < 4.4.6 | 4.4.6 |
| Packagist | moodle/moodle | >= 4.3.0-beta, < 4.3.10 | 4.3.10 |
| Packagist | moodle/moodle | < 4.1.16 | 4.1.16 |
Details
As written in the advisory (Markdown source, shown as plain text).
Additional checks were required to ensure trusttext is applied (when enabled) to glossary entries being restored.
References
External links from the advisory. They lead to third-party sites.