Moodle Multiple Cross-Site Scripting (XSS) Vulnerabilities
Summary
CVE-2015-5336: Moodle multiple cross-site scripting (XSS) vulnerabilities. Affects moodle/moodle across 3 version ranges.
< 2.7.11
>= 2.8.0, < 2.8.9
>= 2.9.0, < 2.9.3
Fixed in 2.7.11, 2.8.9 or 2.9.3, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Moodle is an open-source learning management system (LMS) used by educational institutions worldwide. It provides a platform for creating and managing online courses, quizzes, surveys, and other educational activities. The Moodle software is written in PHP and relies on a database backend. It offers various modules, including a survey module that allows users to create and administer surveys within the Moodle environment.
Vulnerability Detail
Multiple cross-site scripting (XSS) vulnerabilities have been discovered in the survey module of Moodle. These vulnerabilities affect Moodle versions up to 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3. The vulnerabilities can be exploited by remote authenticated users with the student role by submitting a crafted survey answer. This allows the injection of arbitrary web script or HTML code, potentially leading to unauthorized access, data theft, or other malicious activities.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.7.112.7.11composer require moodle/moodle:2.7.11 -
>= 2.8.0, < 2.8.92.8.9composer require moodle/moodle:2.8.9 -
>= 2.9.0, < 2.9.32.9.3composer require moodle/moodle:2.9.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for these vulnerabilities. It is essential to apply the recommended fixes by upgrading to the latest version of Moodle.
Conclusion
Multiple cross-site scripting vulnerabilities have been identified in the survey module of Moodle. These vulnerabilities can be exploited by authenticated users with the student role, allowing the injection of malicious code. It is crucial to upgrade to the latest version of Moodle to mitigate these vulnerabilities. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for moodle/moodle →
FAQ
Moodle is an open-source learning management system used for creating and managing online courses.
The survey module is a component of Moodle that allows users to create and administer surveys within the Moodle environment.
Cross-site scripting vulnerabilities occur when an application does not properly validate user input, allowing malicious scripts to be injected and executed in users' browsers.
Users of Moodle versions up to 2.9.3 are affected by these vulnerabilities.
To fix these vulnerabilities, upgrade to Moodle versions 2.7.11, 2.8.9, or 2.9.3.
References
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
