CVE-2010-2230: Moodle Cross-site Scripting vulnerability in the KSES text cleaning filter
Summary
CVE-2010-2230: Moodle Cross-site Scripting vulnerability in the KSES text cleaning filter. Affects moodle/moodle across 2 version ranges.
< 1.8.13
>= 1.9.0, < 1.9.9
Fixed in 1.8.13 or 1.9.9, depending on the release line you run. How to fix ↓
Also tracked for
- wordpress · Debian:11
The same CVE-2010-2230 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning management system (LMS) used for creating and delivering online courses. It provides a platform for educators to create interactive and collaborative learning environments. The KSES text cleaning filter in Moodle is responsible for sanitizing user-generated content to prevent cross-site scripting (XSS) attacks. However, prior to versions 1.8.13 and 1.9.9, the filter did not properly handle vbscript URIs, leaving the system vulnerable to XSS attacks.
Vulnerability Detail
The vulnerability in the KSES text cleaning filter allows remote authenticated users to conduct XSS attacks by injecting malicious HTML input. By exploiting this vulnerability, an attacker can execute arbitrary scripts in the context of other users, potentially leading to session hijacking, defacement, or the theft of sensitive information.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.8.131.8.13composer require moodle/moodle:1.8.13 -
>= 1.9.0, < 1.9.91.9.9composer require moodle/moodle:1.9.9
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If updating Moodle is not immediately feasible, a temporary workaround is to manually sanitize user-generated content to remove any potentially malicious HTML input. This can be done by implementing custom input filters or using third-party libraries that provide robust HTML sanitization functionality.
Conclusion
The Moodle Cross-site Scripting vulnerability in the KSES text cleaning filter can be mitigated by updating Moodle to the recommended versions or by implementing custom input filters to sanitize user-generated content. It is crucial to address this vulnerability promptly to protect users' data and ensure the secure operation of the Moodle platform. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for moodle/moodle →
FAQ
Moodle is an open-source learning management system (LMS) used for creating and delivering online courses.
Cross-site scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users.
The KSES text cleaning filter in Moodle sanitizes user-generated content to prevent XSS attacks by removing or encoding potentially dangerous HTML tags and attributes.
Exploiting this vulnerability can lead to session hijacking, defacement of Moodle pages, or the theft of sensitive information from users.
You can use Vulert's playground at Vulert Scanner to check if your Moodle installation is affected by this vulnerability. Simply upload your composer.lock file to the playground, and it will alert you if your application is vulnerable.
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
