CVE-2014-7830: Moodle cross-site scripting (XSS) vulnerability

moodle/moodle Updated 02 Oct 2025

Summary

13/05/2022

Disclosed on

CVE-2014-7830

CVE

Yes i

Fix available

Low

Severity

Not published

CVSS Score

CVE-2014-7830: Moodle cross-site scripting (XSS) vulnerability. Affects moodle/moodle across 3 version ranges.

< 2.5.9 >= 2.6.0, < 2.6.6 >= 2.7.0, < 2.7.3

Fixed in 2.5.9, 2.6.6 or 2.7.3, depending on the release line you run. How to fix ↓

Free scan

Check if this vulnerability affects your application

Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.

Check my app free

No signup required · Results in about 60 seconds

Upload your dependency manifest or SBOM

Drag & drop your file here or Browse

Java Javascript PHP Python Go Rust Ruby Dart C/C++ Elixir CycloneDX SPDX

Upload a supported dependency manifest or SBOM. No installation or source-code access required.

See supported files and SBOM formats

SBOM sbom.json · bom.json · bom.xml · *.spdx.json · *.cdx.json · *.cdx.xml

Java pom.xml · gradle.lockfile · buildscript-gradle.lockfile

Javascript package-lock.json · yarn.lock · pnpm-lock.yaml

PHP composer.lock

Python poetry.lock · requirements.txt · Pipfile.lock

Go go.mod

Rust Cargo.lock

Ruby Gemfile.lock

Dart pubspec.lock

C/C++ conan.lock

Elixir mix.lock

Enter your work email to receive your report link.

Verify your email to view the full report and start 30 days of continuous monitoring. No credit card required.

Background

Moodle is an open-source learning management system (LMS) used by educational institutions to create and deliver online courses. It provides various modules and features to facilitate teaching and learning activities. The Feedback module in Moodle allows instructors to collect feedback from students. However, versions of Moodle up to 2.7.3 are vulnerable to a cross-site scripting (XSS) attack in the mod/feedback/mapcourse.php script. This vulnerability can be exploited by authenticated users with the 'mod/feedback:mapcourse' capability, allowing them to inject arbitrary web script or HTML by providing a malicious searchcourse parameter.

Vulnerability Detail

The cross-site scripting (XSS) vulnerability in Moodle's Feedback module allows authenticated users to inject malicious web script or HTML. By leveraging the 'mod/feedback:mapcourse' capability, an attacker can provide a specially crafted searchcourse parameter to execute arbitrary code in the context of other users accessing the affected page. This can lead to various security risks, including session hijacking, defacement of web pages, and theft of sensitive information.

How To Fix

Fixed versions by release line

The minimum fixed version depends on the release line you run.

< 2.5.9 2.5.9
```
composer require moodle/moodle:2.5.9
```
>= 2.6.0, < 2.6.6 2.6.6
```
composer require moodle/moodle:2.6.6
```
>= 2.7.0, < 2.7.3 2.7.3
```
composer require moodle/moodle:2.7.3
```

Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →

Workaround

If upgrading to the latest version is not immediately feasible, a temporary workaround can be implemented by disabling the 'mod/feedback:mapcourse' capability for untrusted users. This can be done by modifying the Moodle permissions settings to remove the capability from the relevant user roles. By doing so, the risk of exploitation can be reduced until the upgrade can be performed.

Conclusion

The Moodle Feedback module is vulnerable to a cross-site scripting (XSS) attack, which can be mitigated by upgrading to versions 2.5.9, 2.6.6, or 2.7.3. If immediate upgrade is not possible, disabling the 'mod/feedback:mapcourse' capability for untrusted users can provide temporary protection. For further assistance in vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for moodle/moodle →