CVE-2015-0212: Moodle cross-site scripting (XSS) vulnerability
Summary
CVE-2015-0212: Moodle cross-site scripting (XSS) vulnerability. Affects moodle/moodle across 3 version ranges.
< 2.6.7
>= 2.7.0, < 2.7.4
>= 2.8.0, < 2.8.2
Fixed in 2.6.7, 2.7.4 or 2.8.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning management system (LMS) used by educational institutions to create and deliver online courses. It provides a platform for educators to manage course materials, interact with students, and track their progress. Moodle is widely adopted and has a large user base. However, it is susceptible to security vulnerabilities, including cross-site scripting (XSS) attacks.
Vulnerability Detail
The identified vulnerability, CVE-2015-0212, is a cross-site scripting (XSS) vulnerability in Moodle versions prior to 2.6.7, 2.7.4, and 2.8.2. This vulnerability allows remote authenticated users to inject arbitrary web script or HTML into the course summary field. An attacker can exploit this vulnerability by crafting a malicious course summary, which, when viewed by other users, executes the injected script or HTML in their browsers. This can lead to various consequences, such as session hijacking, defacement of web pages, or theft of sensitive information.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.6.72.6.7composer require moodle/moodle:2.6.7 -
>= 2.7.0, < 2.7.42.7.4composer require moodle/moodle:2.7.4 -
>= 2.8.0, < 2.8.22.8.2composer require moodle/moodle:2.8.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the provided patches or upgrade to the fixed versions to ensure the security of the Moodle installation.
Conclusion
The identified vulnerability in Moodle allows for cross-site scripting (XSS) attacks, which can have serious security implications. It is recommended to upgrade to the fixed versions or apply the provided patches to mitigate the risk. For further assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for moodle/moodle →
FAQ
Moodle is an open-source learning management system (LMS) used by educational institutions to create and deliver online courses.
Cross-site scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users.
An attacker can exploit this vulnerability by crafting a malicious course summary that contains script or HTML code. When other users view the course, the injected code is executed in their browsers.
The consequences of this vulnerability can include session hijacking, defacement of web pages, or theft of sensitive information.
To protect your Moodle installation, it is crucial to upgrade to the patched versions (2.6.7, 2.7.4, or 2.8.2) or apply the provided patches as soon as possible.
References
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
