CVE-2017-2645: Moodle XSS in attachments to evidence of prior learning
Summary
CVE-2017-2645: Moodle XSS in attachments to evidence of prior learning. Affects moodle/moodle across 2 version ranges.
>= 3.1, < 3.1.5
>= 3.2, < 3.2.2
Fixed in 3.1.5 or 3.2.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning management system used by educational institutions worldwide. It provides a platform for creating and managing online courses, allowing educators to deliver content and interact with students. Moodle supports various features, including the ability to attach evidence of prior learning to course materials. This vulnerability specifically affects Moodle versions 3.1 and 3.2.
Vulnerability Detail
The vulnerability in Moodle 3.x allows for cross-site scripting (XSS) attacks through attachments to evidence of prior learning. This means that an attacker can inject malicious code into the attachments, which will be executed when accessed by other users. The impact of this vulnerability can range from unauthorized access to sensitive information to the execution of arbitrary code on the user's browser.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 3.1, < 3.1.53.1.5composer require moodle/moodle:3.1.5 -
>= 3.2, < 3.2.23.2.2composer require moodle/moodle:3.2.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. The recommended solution is to upgrade to the patched versions of Moodle as mentioned above.
Conclusion
In conclusion, the Moodle vulnerability CVE-2017-2645 allows for cross-site scripting attacks through attachments to evidence of prior learning. To mitigate this vulnerability, it is recommended to upgrade to the patched versions of Moodle (3.1.5 or 3.2.2). For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for moodle/moodle →
FAQ
Moodle is an open-source learning management system used by educational institutions to create and manage online courses.
Evidence of prior learning in Moodle refers to attachments or documents that students can provide to demonstrate their previous knowledge or achievements.
Cross-site scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users.
The potential consequences of this vulnerability include unauthorized access to sensitive information, manipulation of user data, and the execution of arbitrary code on users' browsers.
To protect your Moodle installation, it is crucial to keep it up to date with the latest security patches. Ensure that you regularly check for updates and apply them promptly.
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
