CVE-2010-1614: Moodle Cross-site Scripting Vulnerability
Summary
CVE-2010-1614: Moodle vulnerable to Cross-site Scripting. Affects moodle/moodle across 2 version ranges.
>= 1.8.0, < 1.8.12
>= 1.9.0, < 1.9.8
Fixed in 1.8.12 or 1.9.8, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning platform designed to provide educators, administrators, and learners with a single robust, secure, and integrated system to create personalized learning environments. It is widely used in educational institutions for course management, online learning, and collaborative activities. However, certain versions of Moodle are vulnerable to cross-site scripting (XSS) attacks, which can compromise user data and application integrity.
Vulnerability Detail
Multiple cross-site scripting (XSS) vulnerabilities exist in Moodle versions 1.8.x before 1.8.12 and 1.9.x before 1.9.8. These vulnerabilities allow remote attackers to inject arbitrary web scripts or HTML through the Login-As feature and unspecified global search forms when the global search feature is enabled. The exploitation of these vulnerabilities can lead to unauthorized actions being performed on behalf of users, potentially resulting in data theft or manipulation.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 1.8.0, < 1.8.121.8.12composer require moodle/moodle:1.8.12 -
>= 1.9.0, < 1.9.81.9.8composer require moodle/moodle:1.9.8
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, consider disabling the Login-As feature and the global search feature until the update can be applied. This can help mitigate the risk of exploitation while you prepare for the upgrade.
Conclusion
The identified cross-site scripting vulnerabilities in Moodle versions 1.8.x and 1.9.x pose significant risks to users and data integrity. It is crucial to update to the latest patched versions to mitigate these risks and ensure a secure learning environment.
See every vulnerability recorded for moodle/moodle →
FAQ
Cross-site scripting (XSS) is a security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users, potentially compromising their data and session.
If you are using Moodle versions 1.8.x before 1.8.12 or 1.9.x before 1.9.8, your installation is vulnerable. You can use Vulert to check if your application is affected without requiring access to the code.
Failing to address this vulnerability can lead to unauthorized access to user accounts, data theft, and potential manipulation of course content, which can severely impact the integrity of the learning environment.
Yes, you can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities in your software by analyzing the composer.lock file.
Regularly update your Moodle installation to the latest versions, monitor for vulnerabilities using tools like Vulert, and follow best security practices for web applications.
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
