CVE-2011-4280: Moodle vulnerable to XSS via bundled spikephpcoverage library
Summary
CVE-2011-4280: Moodle vulnerable to XSS via bundled spikephpcoverage library. Affects moodle/moodle versions >= 2.0, < 2.0.2. Fixed in 2.0.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning management system (LMS) used by educational institutions worldwide. It provides a platform for creating and delivering online courses, managing assessments, and facilitating collaboration among students and instructors. Moodle is built on PHP and utilizes various libraries and plugins to enhance its functionality. One such library is Spike PHPCoverage (spikephpcoverage), which is bundled with Moodle. This library is responsible for code coverage analysis in Moodle. However, a vulnerability in this library allows remote attackers to inject arbitrary web script or HTML into Moodle.
Vulnerability Detail
The vulnerability in the Spike PHPCoverage library allows for cross-site scripting (XSS) attacks. By exploiting this vulnerability, remote attackers can inject malicious code or HTML into Moodle, potentially compromising the security and integrity of the system. The exact vectors through which the attack can be carried out are unspecified. However, it is crucial to address this vulnerability promptly to prevent potential exploitation.
How To Fix
Minimum fixed version
2.0.2
This is the first release that contains the fix.
composer require moodle/moodle:2.0.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, users can mitigate the risk by updating Moodle to the latest version as mentioned in the 'how_to_fix' section.
Conclusion
The vulnerability in Moodle's bundled spikephpcoverage library exposes the system to cross-site scripting (XSS) attacks. To mitigate this risk, it is crucial to update Moodle to version 2.0.2 or later. By doing so, users can ensure the security and integrity of their Moodle installation. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for moodle/moodle →
FAQ
Moodle is an open-source learning management system (LMS) used by educational institutions for online course management and collaboration.
Spike PHPCoverage is a library bundled with Moodle that provides code coverage analysis functionality.
Cross-site scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users.
This vulnerability can be exploited by remote attackers who can inject arbitrary web script or HTML into Moodle, potentially compromising its security.
To protect your Moodle installation, it is recommended to update to the latest version, which includes a patch for this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
