CVE-2010-1619: Moodle Cross-site Scripting Vulnerability in KSES HTML Cleaning Library
Summary
CVE-2010-1619: Moodle vulnerable to Cross-site Scripting. Affects moodle/moodle across 2 version ranges.
>= 1.8.0, < 1.8.12
>= 1.9.0, < 1.9.8
Fixed in 1.8.12 or 1.9.8, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Moodle is an open-source learning platform designed to provide educators, administrators, and learners with a single robust, secure, and integrated system to create personalized learning environments. It supports various functionalities such as course management, user management, and content delivery. However, certain versions of Moodle are vulnerable to a Cross-site Scripting (XSS) attack due to flaws in the KSES HTML text cleaning library, which can allow attackers to inject malicious scripts into web pages.
Vulnerability Detail
The vulnerability arises from the fix_non_standard_entities function in the KSES HTML text cleaning library (weblib.php). This flaw exists in Moodle versions 1.8.x prior to 1.8.12 and 1.9.x prior to 1.9.8. Attackers can exploit this vulnerability by crafting HTML entities that, when processed by the affected versions of Moodle, can lead to arbitrary web script or HTML injection. This could result in unauthorized actions being performed on behalf of users, data theft, or the distribution of malware.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 1.8.0, < 1.8.121.8.12composer require moodle/moodle:1.8.12 -
>= 1.9.0, < 1.9.81.9.8composer require moodle/moodle:1.9.8
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users can disable the processing of HTML entities in user-generated content until the update is applied. However, this may limit the functionality of the platform and should only be considered a short-term measure.
Conclusion
The CVE-2010-1619 vulnerability in Moodle poses a significant risk due to its potential for Cross-site Scripting attacks. It is crucial for users to update to the latest patched versions to safeguard their applications and users from potential exploitation.
See every vulnerability recorded for moodle/moodle →
FAQ
Cross-site Scripting (XSS) is a security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users.
Moodle versions 1.8.x before 1.8.12 and 1.9.x before 1.9.8 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
Exploitation of this vulnerability can lead to unauthorized actions, data theft, and the distribution of malware, compromising user security.
A temporary workaround is to disable the processing of HTML entities in user-generated content, but this may limit functionality.
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
