CVE-2014-3544: Moodle cross-site scripting (XSS) vulnerability
Summary
CVE-2014-3544: Moodle cross-site scripting (XSS) vulnerability. Affects moodle/moodle across 4 version ranges.
< 2.4.11
>= 2.5.0, < 2.5.7
>= 2.6.0, < 2.6.4
>= 2.7.0, < 2.7.1
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning management system (LMS) used for creating and delivering online courses. It provides a platform for educators to create interactive and collaborative learning environments. Moodle is widely used in educational institutions and organizations around the world. However, a cross-site scripting (XSS) vulnerability has been discovered in Moodle versions 2.3.11 through 2.7.1. This vulnerability allows remote authenticated users to inject arbitrary web script or HTML via the Skype ID profile field.
Vulnerability Detail
The cross-site scripting (XSS) vulnerability in Moodle allows remote authenticated users to exploit the Skype ID profile field to inject malicious web script or HTML. This can lead to various security risks, including session hijacking, data theft, and unauthorized access to sensitive information. The vulnerability arises from inadequate input validation and sanitization of user-supplied data in the profile.php file. Attackers can craft specially crafted Skype IDs to execute arbitrary code in the context of other users' browsers.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.4.112.4.11composer require moodle/moodle:2.4.11 -
>= 2.5.0, < 2.5.72.5.7composer require moodle/moodle:2.5.7 -
>= 2.6.0, < 2.6.42.6.4composer require moodle/moodle:2.6.4 -
>= 2.7.0, < 2.7.12.7.1composer require moodle/moodle:2.7.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround is to disable the Skype ID profile field in the Moodle user profile settings. This can be done by accessing the Moodle administration panel, navigating to the user profile settings, and removing or disabling the Skype ID field. However, this workaround should only be considered as a temporary measure, and upgrading to the latest version is strongly recommended.
Conclusion
The Moodle cross-site scripting (XSS) vulnerability poses a security risk to Moodle installations running versions 2.3.11 through 2.7.1. It allows remote authenticated users to inject arbitrary web script or HTML via the Skype ID profile field. To mitigate this vulnerability, it is crucial to upgrade to the latest version of Moodle and review any customizations or plugins that may be affected. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for moodle/moodle →
FAQ
Moodle is an open-source learning management system (LMS) used for creating and delivering online courses. It provides a platform for educators to create interactive and collaborative learning environments.
Cross-site scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users. This can lead to various security risks, including session hijacking, data theft, and unauthorized access to sensitive information.
The Moodle XSS vulnerability allows remote authenticated users to inject arbitrary web script or HTML via the Skype ID profile field. Attackers can exploit this vulnerability by crafting specially crafted Skype IDs to execute arbitrary code in the context of other users' browsers.
The potential risks of the Moodle XSS vulnerability include session hijacking, data theft, and unauthorized access to sensitive information. Attackers can use the vulnerability to execute malicious code in the context of other users' browsers, potentially compromising their accounts and the security of the Moodle system.
To fix the Moodle XSS vulnerability, it is recommended to upgrade to the latest version of Moodle (2.4.11, 2.5.7, 2.6.4, or 2.7.1). Upgrading will ensure that the necessary input validation and sanitization measures are in place to prevent XSS attacks. It is also advisable to review and update any customizations or plugins that may be affected by this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
