Moodle Cross-Site Scripting (XSS) Vulnerability in moodle/moodle
Summary
CVE-2015-3178: Moodle cross-site scripting (XSS) vulnerability. Affects moodle/moodle across 3 version ranges.
< 2.6.11
>= 2.7.0, < 2.7.8
>= 2.8.0, < 2.8.6
Fixed in 2.6.11, 2.7.8 or 2.8.6, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning management system (LMS) used by educational institutions to create and manage online courses. It provides a platform for educators to deliver content, interact with students, and assess their progress. The Moodle software is written in PHP and relies on a database to store course materials, user information, and other data. However, a vulnerability has been discovered in Moodle that allows remote authenticated users to inject arbitrary web script or HTML into an external application.
Vulnerability Detail
The vulnerability, identified as a cross-site scripting (XSS) flaw, exists in the external_format_text function in lib/externallib.php in Moodle versions through 2.5.9, 2.6.x before 2.6.11, 2.7.x before 2.7.8, and 2.8.x before 2.8.6. This flaw enables attackers with authenticated access to Moodle to craft a malicious string that can be executed as web script or HTML in an external application. The impact of this vulnerability can range from unauthorized access to sensitive information to complete compromise of the external application's security.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.6.112.6.11composer require moodle/moodle:2.6.11 -
>= 2.7.0, < 2.7.82.7.8composer require moodle/moodle:2.7.8 -
>= 2.8.0, < 2.8.62.8.6composer require moodle/moodle:2.8.6
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. However, administrators can mitigate the risk by ensuring that only trusted users have authenticated access to Moodle and by regularly monitoring and reviewing user-generated content for any signs of malicious activity.
Conclusion
The Moodle software has been found to have a cross-site scripting (XSS) vulnerability that allows authenticated users to inject arbitrary web script or HTML into an external application. To mitigate this risk, it is recommended to upgrade to a patched version of Moodle and review user input for potential malicious content. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for moodle/moodle →
FAQ
Moodle is an open-source learning management system used by educational institutions to create and manage online courses.
Cross-site scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users.
This vulnerability allows authenticated users to inject arbitrary web script or HTML into an external application, potentially leading to unauthorized access or compromise of the application's security.
To fix this vulnerability, you should upgrade your Moodle installation to version 2.6.11, 2.7.8, or 2.8.6 or later. Additionally, you should review and sanitize user input to prevent the execution of malicious scripts or HTML.
While there is no specific workaround provided, administrators can mitigate the risk by ensuring only trusted users have authenticated access to Moodle and by monitoring user-generated content for signs of malicious activity.
References
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
