CVE-2011-4203: Moodle CRLF Injection Vulnerability in Calendar Component
Summary
CVE-2011-4203: Moodle CRLF Injection Vulnerability in Calendar Component. Affects moodle/moodle across 3 version ranges.
< 1.9.15
>= 2.0, < 2.0.6
>= 2.1, < 2.1.3
Fixed in 1.9.15, 2.0.6 or 2.1.3, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning management system (LMS) used by educational institutions to create and deliver online courses. It provides a wide range of features for course management, content creation, and collaboration. The Calendar component in Moodle allows users to schedule and manage events within courses. However, a CRLF injection vulnerability was discovered in the calendar/set.php file in Moodle versions 1.9.x, 2.0.x, 2.1.x, and 2.2. This vulnerability allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks by manipulating the 'url' parameter.
Vulnerability Detail
The CRLF injection vulnerability in Moodle's Calendar component arises from improper handling of user-supplied input in the 'url' parameter. By injecting specific characters, an attacker can manipulate the HTTP response headers and potentially perform various attacks, such as HTTP response splitting. This could lead to session hijacking, cross-site scripting (XSS), or other security breaches. The vulnerability affects Moodle versions 1.9.x to 1.9.15, 2.0.x to 2.0.6, 2.1.x to 2.1.3, and 2.2.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.9.151.9.15composer require moodle/moodle:1.9.15 -
>= 2.0, < 2.0.62.0.6composer require moodle/moodle:2.0.6 -
>= 2.1, < 2.1.32.1.3composer require moodle/moodle:2.1.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the official patches or upgrade to the latest version of Moodle as soon as possible.
Conclusion
The CRLF injection vulnerability in Moodle's Calendar component poses a moderate risk to Moodle installations. It is crucial to upgrade to the latest patched version of Moodle or apply the official patches to mitigate the risk. Regularly updating Moodle and staying informed about security advisories is essential to ensure the security of your Moodle installation.
See every vulnerability recorded for moodle/moodle →
FAQ
The vulnerability allows attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks. This can lead to session hijacking, cross-site scripting (XSS), or other security breaches.
Moodle versions 1.9.x to 1.9.15, 2.0.x to 2.0.6, 2.1.x to 2.1.3, and 2.2 are affected by this vulnerability.
No, there is no known workaround. It is recommended to apply the official patches or upgrade to the latest version of Moodle.
There have been no specific incidents reported related to this vulnerability at this time.
You can find more information about this vulnerability in the official Moodle security advisory or by contacting the Moodle support team.
References
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
