CVE-2014-2571: Moodle cross-site scripting (XSS) vulnerability
Summary
CVE-2014-2571: Moodle cross-site scripting (XSS) vulnerability. Affects moodle/moodle across 3 version ranges.
< 2.4.9
>= 2.5.0, < 2.5.5
>= 2.6.0, < 2.6.2
Fixed in 2.4.9, 2.5.5 or 2.6.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning management system (LMS) used by educational institutions to create and deliver online courses. It provides a platform for educators to create quizzes and assessments for students. The mod/quiz/editlib.php file in Moodle versions prior to 2.4.9, 2.5.5, and 2.6.2 contains a vulnerability that allows remote authenticated users to inject arbitrary web script or HTML into quiz questions, leading to potential cross-site scripting (XSS) attacks.
Vulnerability Detail
The vulnerability exists in the quiz_question_tostring function in the mod/quiz/editlib.php file. Remote authenticated users can exploit this vulnerability by injecting malicious web script or HTML code into quiz questions. When these questions are rendered, the injected code is executed in the context of the user's browser, potentially allowing an attacker to steal sensitive information, perform actions on behalf of the user, or manipulate the content of the page. This vulnerability has a low severity rating.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.4.92.4.9composer require moodle/moodle:2.4.9 -
>= 2.5.0, < 2.5.52.5.5composer require moodle/moodle:2.5.5 -
>= 2.6.0, < 2.6.22.6.2composer require moodle/moodle:2.6.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to a patched version is not immediately possible, a temporary workaround is to disable the use of quiz questions that allow user-generated content. This can be done by modifying the quiz settings to only use pre-defined question types or disabling the quiz module altogether until the upgrade can be performed. However, this workaround may limit the functionality of the system and should only be considered as a temporary measure.
Conclusion
The Moodle cross-site scripting (XSS) vulnerability in the quiz_question_tostring function poses a potential risk to Moodle installations. It is recommended to upgrade to the latest patched version or apply the provided workaround to mitigate the vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for moodle/moodle →
FAQ
Moodle is an open-source learning management system (LMS) used by educational institutions to create and deliver online courses.
Cross-site scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users. This can lead to the theft of sensitive information or the execution of unauthorized actions.
This vulnerability allows remote authenticated users to inject arbitrary web script or HTML into quiz questions, potentially leading to cross-site scripting (XSS) attacks. It can be exploited to steal information, perform actions on behalf of users, or manipulate the content of the page.
To fix this vulnerability, it is recommended to upgrade to Moodle version 2.4.9, 2.5.5, or 2.6.2 or later. These versions contain the necessary patches to mitigate the XSS vulnerability.
If upgrading to a patched version is not immediately possible, a temporary workaround is to disable the use of quiz questions that allow user-generated content. This can be done by modifying the quiz settings to only use pre-defined question types or disabling the quiz module altogether until the upgrade can be performed.
References
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
