CVE-2014-9059: Moodle - Lack of Charset Information in HTTP Headers
Summary
CVE-2014-9059: Moodle does not provide charset information in HTTP headers. Affects moodle/moodle across 3 version ranges.
< 2.5.9
>= 2.6.0, < 2.6.6
>= 2.7.0, < 2.7.3
Fixed in 2.5.9, 2.6.6 or 2.7.3, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning management system (LMS) used by educational institutions to create and manage online courses. It provides a platform for educators to deliver content, interact with students, and assess their progress. Moodle is written in PHP and utilizes a database backend for storing course materials, user information, and other data. This vulnerability affects Moodle versions 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3.
Vulnerability Detail
The vulnerability in Moodle is due to the lack of charset information in HTTP headers. This omission allows remote attackers to exploit the system through cross-site scripting (XSS) attacks by using UTF-7 characters during interactions with AJAX scripts. By injecting malicious code, attackers can potentially execute arbitrary scripts within the context of the affected Moodle instance. This can lead to unauthorized access, data theft, and other security breaches.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.5.92.5.9composer require moodle/moodle:2.5.9 -
>= 2.6.0, < 2.6.62.6.6composer require moodle/moodle:2.6.6 -
>= 2.7.0, < 2.7.32.7.3composer require moodle/moodle:2.7.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround can be implemented by manually adding the charset information to the HTTP headers. This can be done by modifying the 'lib/setup.php' file in the Moodle installation. Specifically, the 'header()' function calls should include the 'Content-Type' header with the appropriate charset value. For example:
header('Content-Type: text/html; charset=UTF-8');
Conclusion
The lack of charset information in HTTP headers in Moodle versions prior to 2.5.9, 2.6.6, and 2.7.3 can expose the system to cross-site scripting (XSS) attacks. Upgrading to the latest version or applying the provided workaround will help mitigate this vulnerability. For further assistance and support in addressing this issue, please contact DevNack.com.
See every vulnerability recorded for moodle/moodle →
FAQ
Moodle is an open-source learning management system used by educational institutions to create and manage online courses.
Cross-site scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users.
This vulnerability can lead to unauthorized access, data theft, and other security breaches if exploited by attackers.
To fix this vulnerability, it is recommended to upgrade to the latest version of Moodle (2.5.9, 2.6.6, or 2.7.3).
Yes, a temporary workaround is to manually add the charset information to the HTTP headers in the 'lib/setup.php' file.
References
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
