CVE-2014-3547: Moodle multiple cross-site scripting (XSS) vulnerabilities
Summary
CVE-2014-3547: Moodle multiple cross-site scripting (XSS) vulnerabilities. Affects moodle/moodle across 3 version ranges.
>= 2.5.0, < 2.5.7
>= 2.6.0, < 2.6.4
>= 2.7.0, < 2.7.1
Fixed in 2.5.7, 2.6.4 or 2.7.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning management system (LMS) used by educational institutions to create and manage online courses. It provides a platform for teachers and students to interact, share resources, and participate in various learning activities. Moodle is written in PHP and utilizes a modular architecture that allows for easy customization and extension. However, multiple cross-site scripting (XSS) vulnerabilities have been discovered in the badges/renderer.php file of Moodle versions 2.5.x, 2.6.x, and 2.7.x. These vulnerabilities can be exploited by remote attackers to inject arbitrary web script or HTML into the application.
Vulnerability Detail
The identified vulnerabilities in Moodle's badges/renderer.php file allow attackers to inject malicious web script or HTML code into the application. This can lead to various security risks, including the execution of arbitrary code in the context of the user's browser, session hijacking, and the theft of sensitive information. The vulnerabilities can be triggered by providing specially crafted input to the affected application, such as through external badges. Successful exploitation of these vulnerabilities can result in the compromise of user accounts, unauthorized access to sensitive data, and the potential for further attacks.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 2.5.0, < 2.5.72.5.7composer require moodle/moodle:2.5.7 -
>= 2.6.0, < 2.6.42.6.4composer require moodle/moodle:2.6.4 -
>= 2.7.0, < 2.7.12.7.1composer require moodle/moodle:2.7.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If updating Moodle immediately is not feasible, a temporary workaround is to disable the use of external badges or restrict their usage to trusted sources only. This can be done by modifying the application configuration or by implementing server-side filtering and validation of badge content. However, this workaround may limit the functionality and flexibility of Moodle's badge system, so updating to the latest patched version is still the recommended solution.
Conclusion
The identified cross-site scripting (XSS) vulnerabilities in Moodle's badges/renderer.php file pose a significant security risk to Moodle installations. It is crucial for administrators to promptly update their Moodle instances to the latest patched versions (2.5.7, 2.6.4, or 2.7.1) to mitigate the risk of exploitation. Regularly applying security updates and following best practices for secure coding and configuration can help maintain the integrity and security of Moodle installations. For further assistance or support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for moodle/moodle →
FAQ
Moodle is an open-source learning management system (LMS) used by educational institutions to create and manage online courses.
Cross-site scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users.
The vulnerabilities can be exploited by remote attackers who provide specially crafted input, such as through external badges, to inject malicious web script or HTML into the application.
The consequences of these vulnerabilities include the execution of arbitrary code in the user's browser, session hijacking, and the theft of sensitive information.
To protect your Moodle installation, it is recommended to update to the latest patched version of Moodle and regularly apply security updates.
References
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
