Moodle XSS from profile fields from external db
Summary
CVE-2016-2152: Moodle XSS from profile fields from external db. Affects moodle/moodle across 4 version ranges.
>= 2.7, < 2.7.13
>= 2.8, < 2.8.11
>= 2.9, < 2.9.5
>= 3.0, < 3.0.3
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning management system (LMS) used by educational institutions worldwide. It provides a platform for creating and managing online courses, allowing educators to deliver content and interact with students. Moodle supports various authentication methods, including the ability to authenticate users against an external database. This feature allows administrators to configure Moodle to use an external database for user authentication. However, a vulnerability in the authentication process exposes Moodle to cross-site scripting (XSS) attacks.
Vulnerability Detail
The vulnerability exists in the auth/db/auth.php file in Moodle versions 2.6.11 through 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3. It allows remote attackers to inject arbitrary web script or HTML through an external DB profile field. This means that an attacker can craft a malicious input that, when displayed on a Moodle page, will execute arbitrary code in the context of the user's browser. This can lead to various security risks, including session hijacking, data theft, and unauthorized access to sensitive information.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 2.7, < 2.7.132.7.13composer require moodle/moodle:2.7.13 -
>= 2.8, < 2.8.112.8.11composer require moodle/moodle:2.8.11 -
>= 2.9, < 2.9.52.9.5composer require moodle/moodle:2.9.5 -
>= 3.0, < 3.0.33.0.3composer require moodle/moodle:3.0.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, administrators can disable the use of external DB profile fields in Moodle. This can be done by modifying the Moodle configuration to remove the option for users to authenticate against an external database. However, this workaround may impact the functionality of certain features that rely on external DB profile fields. It is recommended to apply the official patches and upgrade to the latest version of Moodle as soon as possible.
Conclusion
The XSS vulnerability in Moodle's authentication process exposes the system to potential attacks that can compromise user data and system integrity. It is crucial for administrators to promptly upgrade to the latest version of Moodle and apply the necessary patches to mitigate the risk. Additionally, reviewing and sanitizing external DB profile fields is essential to prevent the injection of malicious scripts or HTML. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for moodle/moodle →
FAQ
Moodle is an open-source learning management system used by educational institutions to create and manage online courses.
Cross-site scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users.
The vulnerability in Moodle allows attackers to inject arbitrary web script or HTML through an external DB profile field. This can lead to various security risks, including session hijacking, data theft, and unauthorized access to sensitive information.
To fix the vulnerability, it is recommended to upgrade to the latest version of Moodle and apply the official patches. Additionally, administrators should review and sanitize any external DB profile fields to prevent the injection of malicious scripts or HTML.
As a temporary workaround, administrators can disable the use of external DB profile fields in Moodle. However, this may impact the functionality of certain features that rely on these fields. It is recommended to apply the official patches and upgrade to the latest version of Moodle as soon as possible.
References
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
