CVE-2011-4282: Moodle Cross-site Scripting Vulnerability in Course Tags Functionality
Summary
CVE-2011-4282: Moodle vulnerable to Cross-site Scripting. Affects moodle/moodle versions >= 2.0.0, < 2.0.2. Fixed in 2.0.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning platform designed to provide educators, administrators, and learners with a single robust, secure, and integrated system to create personalized learning environments. It supports various functionalities such as course management, user enrollment, and content delivery. However, certain versions of Moodle, specifically 2.0.x before 2.0.2, are vulnerable to cross-site scripting (XSS) attacks due to flaws in the course-tags functionality, which can allow attackers to inject malicious scripts.
Vulnerability Detail
The vulnerability arises from multiple cross-site scripting (XSS) flaws in the course-tags functionality located in tag/coursetags_more.php. Attackers can exploit these vulnerabilities by injecting arbitrary web scripts or HTML through the 'sort' or 'show' parameters. This can lead to unauthorized actions being performed on behalf of users, data theft, or the distribution of malware, thereby compromising the security and integrity of the Moodle platform.
How To Fix
Minimum fixed version
2.0.2
This is the first release that contains the fix.
composer require moodle/moodle:2.0.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not possible, a temporary workaround is to sanitize and validate user inputs for the 'sort' and 'show' parameters to prevent script injection. This can be done by implementing input validation checks in the affected PHP file.
Conclusion
In summary, CVE-2011-4282 represents a significant cross-site scripting vulnerability in Moodle versions prior to 2.0.2. It is crucial for users to update their installations to the patched version to mitigate potential security risks. For those unable to update immediately, implementing input validation can serve as a temporary measure.
See every vulnerability recorded for moodle/moodle →
FAQ
CVE-2011-4282 is an identifier for a specific vulnerability in Moodle that allows cross-site scripting attacks through the course-tags functionality.
Moodle versions 2.0.x before 2.0.2 are affected by this vulnerability.
The vulnerability can lead to unauthorized actions, data theft, and the distribution of malware, compromising user security.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
If you cannot update immediately, implement input validation and sanitization for the affected parameters as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
