Cross-Site Scripting (XSS) Vulnerability in Moodle
Summary
CVE-2015-3174: Moodle does not set the RISK_XSS bit for graders. Affects moodle/moodle across 3 version ranges.
< 2.6.11
>= 2.7.0, < 2.7.8
>= 2.8.0, < 2.8.6
Fixed in 2.6.11, 2.7.8 or 2.8.6, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning management system (LMS) used by educational institutions to create and manage online courses. It provides a platform for teachers to create interactive learning materials, conduct assessments, and facilitate communication between students and instructors. Moodle is written in PHP and utilizes a database to store course content, user information, and grades. This vulnerability affects Moodle versions 2.5.9, 2.6.x before 2.6.11, 2.7.x before 2.7.8, and 2.8.x before 2.8.6.
Vulnerability Detail
The vulnerability, identified as GHSA-6r7x-6q98-qcqp, resides in the mod/quiz/db/access.php file of Moodle. It arises from the failure to set the RISK_XSS bit for graders. This oversight allows remote authenticated users to exploit the system by conducting cross-site scripting (XSS) attacks. By submitting crafted gradebook feedback during manual quiz grading, an attacker can inject malicious code into the system, potentially compromising user data and executing unauthorized actions.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.6.112.6.11composer require moodle/moodle:2.6.11 -
>= 2.7.0, < 2.7.82.7.8composer require moodle/moodle:2.7.8 -
>= 2.8.0, < 2.8.62.8.6composer require moodle/moodle:2.8.6
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by upgrading to a patched version of Moodle.
Conclusion
The cross-site scripting (XSS) vulnerability in Moodle poses a risk to user data and system integrity. It is recommended to upgrade to a patched version of Moodle to mitigate this vulnerability. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for moodle/moodle →
FAQ
Moodle is an open-source learning management system (LMS) used for creating and managing online courses.
Cross-site scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users.
Users of Moodle versions 2.5.9, 2.6.x before 2.6.11, 2.7.x before 2.7.8, and 2.8.x before 2.8.6 are affected by this vulnerability.
An attacker can exploit this vulnerability to inject malicious code into the system, potentially compromising user data and executing unauthorized actions.
To protect your Moodle installation, it is crucial to upgrade to a patched version of Moodle that addresses this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
