CVE-2016-2153: Moodle Reflected XSS in mod_data advanced search
Summary
CVE-2016-2153: Moodle Reflected XSS in mod_data advanced search. Affects moodle/moodle across 4 version ranges.
>= 2.7, < 2.7.13
>= 2.8, < 2.8.11
>= 2.9, < 2.9.5
>= 3.0, < 3.0.3
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning management system (LMS) used by educational institutions worldwide. It provides a platform for creating and managing online courses, allowing educators to deliver content and interact with students. The mod_data module in Moodle allows users to create and manage structured data sets within courses. This module includes an advanced search feature that enables users to search for specific data entries based on various criteria.
Vulnerability Detail
A cross-site scripting (XSS) vulnerability was discovered in the advanced-search feature of the mod_data module in Moodle. This vulnerability affects Moodle versions up to 2.6.11, 2.7.x up to 2.7.13, 2.8.x up to 2.8.11, 2.9.x up to 2.9.5, and 3.0.x up to 3.0.3. An attacker can exploit this vulnerability by injecting crafted script or HTML code into a field in a URL. When a user interacts with the search form, the injected code is executed in the context of the user's browser, potentially leading to unauthorized access, data theft, or other malicious activities.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 2.7, < 2.7.132.7.13composer require moodle/moodle:2.7.13 -
>= 2.8, < 2.8.112.8.11composer require moodle/moodle:2.8.11 -
>= 2.9, < 2.9.52.9.5composer require moodle/moodle:2.9.5 -
>= 3.0, < 3.0.33.0.3composer require moodle/moodle:3.0.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround can be implemented by disabling the mod_data module or restricting access to the advanced-search feature. Disabling the module will prevent any potential exploitation of the vulnerability. However, this workaround may impact the functionality of the mod_data module and limit its usage until the upgrade can be performed.
Conclusion
The Moodle mod_data module is vulnerable to a reflected XSS attack, which can be exploited by injecting malicious code into a URL field. Upgrading to the latest version of Moodle or applying the workaround will address this vulnerability. Regularly updating Moodle is crucial to ensure the security of the platform and protect against potential threats. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for moodle/moodle →
FAQ
Moodle is an open-source learning management system (LMS) used by educational institutions to create and manage online courses.
The mod_data module in Moodle allows users to create and manage structured data sets within courses.
The advanced-search feature in mod_data enables users to search for specific data entries based on various criteria.
A cross-site scripting (XSS) vulnerability allows attackers to inject malicious code into web pages viewed by other users.
To mitigate this vulnerability, it is recommended to upgrade to the latest version of Moodle or apply the provided workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
