CVE-2018-1136: Moodle Cross-site Scripting
Summary
CVE-2018-1136: Moodle Cross-site Scripting. Affects moodle/moodle across 4 version ranges.
>= 3.1, < 3.1.12
>= 3.2, < 3.2.9
>= 3.3, < 3.3.6
>= 3.4, < 3.4.3
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning management system used by educational institutions to create and deliver online courses. It provides a platform for educators to create interactive learning environments and engage with students. Moodle allows users to customize their personal dashboard by adding HTML blocks. However, a security vulnerability in Moodle versions 3.x allows authenticated users to add HTML blocks containing scripts to their Dashboard. While personal dashboards are normally visible only to the user, this vulnerability enables users to move such blocks to other pages where they can be viewed by other users.
Vulnerability Detail
The vulnerability in Moodle 3.x allows authenticated users to inject malicious scripts into HTML blocks on their personal dashboard. These scripts can then be moved to other pages where they are visible to other users. This cross-site scripting (XSS) vulnerability can be exploited to perform various attacks, such as stealing sensitive information, session hijacking, or delivering malware to unsuspecting users. The vulnerability has a CVSS score of 4.3, indicating a moderate severity level.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 3.1, < 3.1.123.1.12composer require moodle/moodle:3.1.12 -
>= 3.2, < 3.2.93.2.9composer require moodle/moodle:3.2.9 -
>= 3.3, < 3.3.63.3.6composer require moodle/moodle:3.3.6 -
>= 3.4, < 3.4.33.4.3composer require moodle/moodle:3.4.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, administrators can disable the ability for users to add HTML blocks to their personal dashboard. This can be done by modifying the Moodle configuration settings to restrict the use of HTML blocks or by implementing custom code to sanitize and validate the content of HTML blocks before allowing them to be displayed.
Conclusion
The vulnerability in Moodle 3.x allows authenticated users to inject malicious scripts into HTML blocks and move them to other pages. To mitigate this vulnerability, it is crucial to upgrade to the patched versions or implement a workaround. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for moodle/moodle →
FAQ
Moodle is an open-source learning management system used by educational institutions to create and deliver online courses.
Cross-site scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users.
This vulnerability allows authenticated users to inject malicious scripts into HTML blocks on their personal dashboard, which can then be moved to other pages where they are visible to other users.
The consequences of this vulnerability include the potential theft of sensitive information, session hijacking, and the delivery of malware to unsuspecting users.
To protect your Moodle installation, it is recommended to upgrade to the patched versions (3.1.12, 3.2.9, 3.3.6, or 3.4.3) or implement a workaround that restricts the use of HTML blocks or sanitizes their content.
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
