CVE-2011-4299: Moodle Cross-Site Scripting Vulnerability in Wiki Module
Summary
CVE-2011-4299: Moodle vulnerable to Cross-Site Scripting. Affects moodle/moodle across 2 version ranges.
>= 2.0.0, < 2.0.5
>= 2.1.0, < 2.1.2
Fixed in 2.0.5 or 2.1.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning platform designed to provide educators, administrators, and learners with a single robust, secure, and integrated system to create personalized learning environments. The platform supports various functionalities, including course management, user enrollment, and collaborative tools like wikis. However, certain versions of Moodle are vulnerable to a Cross-Site Scripting (XSS) attack, particularly in the wiki module, which allows users to inject malicious scripts through comments.
Vulnerability Detail
The Cross-Site Scripting (XSS) vulnerability in Moodle's wiki module (mod/wiki/pagelib.php) affects versions 2.0.x before 2.0.5 and 2.1.x before 2.1.2. This vulnerability allows remote authenticated users to inject arbitrary web scripts or HTML via a wiki comment. If exploited, this could lead to unauthorized actions being performed on behalf of the user, data theft, or the spread of malware, compromising the integrity and security of the Moodle platform.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 2.0.0, < 2.0.52.0.5composer require moodle/moodle:2.0.5 -
>= 2.1.0, < 2.1.22.1.2composer require moodle/moodle:2.1.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, administrators can restrict user permissions for commenting on wiki pages or sanitize user inputs to prevent script injections. However, this is not a permanent solution and upgrading is strongly advised.
Conclusion
The Cross-Site Scripting vulnerability in Moodle's wiki module poses a significant risk to users and the integrity of the platform. It is crucial for administrators to update to the latest patched versions to mitigate this risk. Utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for moodle/moodle →
FAQ
Cross-Site Scripting (XSS) is a security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users.
If you are using Moodle versions 2.0.x before 2.0.5 or 2.1.x before 2.1.2, your installation is vulnerable. You can also use Vulert to check for vulnerabilities in your application.
Not addressing this vulnerability can lead to unauthorized access, data breaches, and potential damage to your users' trust and your institution's reputation.
Yes, Vulert can monitor your application for open-source vulnerabilities in real-time using just the composer.lock file, providing alerts for any issues.
Yes, you can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
