CVE-2018-14631: Moodle Cross-site Scripting
Summary
CVE-2018-14631: Moodle Cross-site Scripting. Affects moodle/moodle across 3 version ranges.
>= 3.3, < 3.3.8
>= 3.4, < 3.4.5
>= 3.5, < 3.5.2
Fixed in 3.3.8, 3.4.5 or 3.5.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning management system used by educational institutions worldwide. It provides a platform for creating and managing online courses, allowing educators to deliver content and interact with students. Moodle is written in PHP and utilizes a variety of themes to customize the user interface. One such theme is Boost, which offers a modern and responsive design. However, versions of Moodle prior to 3.5.2, 3.4.5, and 3.3.8 are vulnerable to a cross-site scripting (XSS) attack in the Boost theme's blog search functionality.
Vulnerability Detail
The vulnerability arises from insufficient filtering of the 'blog search' GET parameter in the breadcrumb navigation provided by the Boost theme. This allows an attacker to inject malicious JavaScript code into the search parameter, which is then reflected back to the user when they follow a specially crafted link. If a user clicks on this link, the injected JavaScript code will be executed in their browser, potentially leading to unauthorized actions or data theft. The severity of this vulnerability is rated as MODERATE with a CVSS score of 6.1.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 3.3, < 3.3.83.3.8composer require moodle/moodle:3.3.8 -
>= 3.4, < 3.4.53.4.5composer require moodle/moodle:3.4.5 -
>= 3.5, < 3.5.23.5.2composer require moodle/moodle:3.5.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. Upgrading to the patched versions is the only solution.
Conclusion
The vulnerability in Moodle's Boost theme allows for cross-site scripting (XSS) attacks, potentially leading to unauthorized actions or data theft. Users should upgrade to the patched versions to mitigate the risk of exploitation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for moodle/moodle →
FAQ
Moodle is an open-source learning management system used by educational institutions to create and manage online courses.
The Boost theme is a customizable user interface theme for Moodle that provides a modern and responsive design.
Cross-site scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users.
This vulnerability allows an attacker to execute arbitrary JavaScript code in the context of a Moodle user's browser, potentially leading to unauthorized actions or data theft.
To protect your Moodle installation, it is recommended to upgrade to the patched versions (3.3.8, 3.4.5, or 3.5.2) as soon as possible.
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
