CVE-2014-3551: Moodle multiple cross-site scripting (XSS) vulnerabilities
Summary
CVE-2014-3551: Moodle multiple cross-site scripting (XSS) vulnerabilities. Affects moodle/moodle across 4 version ranges.
< 2.4.11
>= 2.5.0, < 2.5.7
>= 2.6.0, < 2.6.4
>= 2.7.0, < 2.7.1
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning management system (LMS) used by educational institutions to create and deliver online courses. It provides a platform for educators to create interactive learning environments and manage student activities. Moodle is widely adopted and has a large user base. However, it is susceptible to multiple cross-site scripting (XSS) vulnerabilities.
Vulnerability Detail
The advanced-grading implementation in Moodle versions through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 contains multiple XSS vulnerabilities. These vulnerabilities allow remote authenticated users to inject arbitrary web script or HTML by exploiting crafted qualification or rating fields in a rubric. An attacker could use this vulnerability to execute malicious code in the context of other users, potentially leading to session hijacking, data theft, or other unauthorized actions.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.4.112.4.11composer require moodle/moodle:2.4.11 -
>= 2.5.0, < 2.5.72.5.7composer require moodle/moodle:2.5.7 -
>= 2.6.0, < 2.6.42.6.4composer require moodle/moodle:2.6.4 -
>= 2.7.0, < 2.7.12.7.1composer require moodle/moodle:2.7.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the official patches or update to the fixed versions of Moodle to eliminate the risk of exploitation.
Conclusion
Multiple cross-site scripting (XSS) vulnerabilities have been identified in Moodle versions prior to 2.4.11, 2.5.7, 2.6.4, and 2.7.1. These vulnerabilities can be exploited by authenticated users to inject malicious scripts or HTML, potentially leading to various security risks. To mitigate the risk, it is recommended to update Moodle to the fixed versions or apply the official patches. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for moodle/moodle →
FAQ
Moodle is an open-source learning management system (LMS) used by educational institutions to create and deliver online courses.
Cross-site scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users. It can be used to steal sensitive information, perform unauthorized actions, or hijack user sessions.
An attacker with authenticated access to Moodle can exploit these vulnerabilities by crafting malicious qualification or rating fields in a rubric. When other users view or interact with the affected pages, the injected script or HTML will execute in their browsers, potentially leading to various security risks.
The consequences of these vulnerabilities include session hijacking, data theft, unauthorized actions on behalf of other users, and the potential for further exploitation of the affected Moodle instance.
To protect your Moodle instance, it is crucial to keep the software up to date by applying the latest security patches and updates. Regularly monitoring security advisories and promptly applying fixes is essential to mitigate the risk of XSS vulnerabilities and other security issues.
References
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
