Description
A flaw was found in Moodle. The XML grade import feature lacks proper Cross-Site Request Forgery (CSRF) token validation. By tricking an authenticated user with grade management permissions into visiting a malicious webpage, an attacker can trigger unauthorized requests on the victim's behalf. This flaw allows a remote attacker to set or overwrite student grades without authorization.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
moodle
Default version status: unaffected
5.2.0 to < 5.2.2affected5.1.0 to < 5.1.6affected5.0.0 to < 5.0.9affected0 to < 4.5.13affected