Moodle Glossary Module Trusttext Bypass Vulnerability

A vulnerability exists in the Moodle glossary module, specifically in versions 4.5 prior to 4.5.1, 4.4 prior to 4.4.5, 4.3 prior to 4.3.9, 4.1 prior to 4.1.15, and earlier unsupported versions. The issue allows teachers to bypass the trusttext configuration when restoring glossary entries. This occurs because additional checks were needed to ensure that the trusttext feature, when enabled, is properly applied to glossary entries being restored.

Impact

Exploitation of this vulnerability could lead to unauthorized evasion of the trusttext configuration, allowing for potential manipulation of glossary entry content.

Remediation

Users can upgrade to Moodle versions 4.5.2, 4.4.6, 4.3.10, or 4.1.16 to address this vulnerability.