CVE-2019-14884: Moodle reflected Cross-site Scripting (XSS)
Summary
CVE-2019-14884: Moodle reflected Cross-site Scripting (XSS). Affects moodle/moodle across 3 version ranges.
>= 3.5.0, < 3.5.9
>= 3.6.0, < 3.6.7
>= 3.7.0, < 3.7.3
Fixed in 3.5.9, 3.6.7 or 3.7.3, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning management system (LMS) used by educational institutions to create and deliver online courses. It provides a platform for educators to manage and organize course materials, assessments, and communication with students. Moodle is written in PHP and utilizes a database backend. This vulnerability affects Moodle versions 3.7 before 3.7.3, 3.6 before 3.6.7, and 3.5 before 3.5.9.
Vulnerability Detail
The vulnerability identified as CVE-2019-14884 is a reflected Cross-site Scripting (XSS) issue. It is possible to exploit this vulnerability by injecting malicious code into certain fatal error messages. When these error messages are displayed to users, the injected code is executed in their browsers, potentially leading to unauthorized access, data theft, or other malicious activities.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 3.5.0, < 3.5.93.5.9composer require moodle/moodle:3.5.9 -
>= 3.6.0, < 3.6.73.6.7composer require moodle/moodle:3.6.7 -
>= 3.7.0, < 3.7.33.7.3composer require moodle/moodle:3.7.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fixes by upgrading to the patched versions of Moodle.
Conclusion
The Moodle reflected Cross-site Scripting (XSS) vulnerability (CVE-2019-14884) poses a moderate risk to Moodle installations. It is crucial to upgrade to the latest patched versions to mitigate the risk of unauthorized access and potential data theft. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for moodle/moodle →
FAQ
Moodle is an open-source learning management system used by educational institutions for online course management.
Reflected XSS is a type of security vulnerability where an attacker can inject malicious code into a website, which is then reflected back to the user's browser and executed.
Exploiting this vulnerability can lead to unauthorized access, data theft, or other malicious activities.
Upgrade your Moodle installation to the latest patched version: 3.7.3 for Moodle 3.7, 3.6.7 for Moodle 3.6, and 3.5.9 for Moodle 3.5.
No, there is no known workaround for this vulnerability. Upgrading to the patched versions is the recommended solution.
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
