CVE-2019-18210: Moodle Persistent Cross-site Scripting (XSS)
Summary
CVE-2019-18210: Moodle Persistent Cross-site Scripting (XSS). Affects moodle/moodle versions >= 3.7, <= 3.7.2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Moodle is an open-source learning management system widely used for online education. It provides a platform for educators to create and manage courses, interact with students, and deliver educational content. The vulnerability described here affects Moodle versions up to 3.7.2. Moodle allows authenticated users with Teacher or higher roles to inject malicious JavaScript code into the session of another user, such as an enrolled student or a site administrator. This can be done through the 'introeditor[text]' parameter in the 'course/modedit.php' endpoint. It is important to note that there is a disagreement between the discoverer and the vendor regarding the expectation of trust for users with the Teacher role to add arbitrary JavaScript. The vendor considers this report a false positive and not a bug.
Vulnerability Detail
The vulnerability in Moodle allows authenticated users with the Teacher role or higher to perform a persistent cross-site scripting (XSS) attack. By injecting JavaScript code into the 'introeditor[text]' parameter, an attacker can execute arbitrary code within the context of another user's session. This can lead to various security risks, including unauthorized access, data theft, and privilege escalation. The impact of this vulnerability depends on the intentions of the attacker and the privileges of the targeted user. It is worth noting that the ability to add arbitrary JavaScript code was not documented on Moodle's Teacher_role page.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. However, as a general security practice, it is advisable to limit the privileges of users and restrict the execution of arbitrary JavaScript code. Administrators can also consider implementing additional security measures, such as web application firewalls or input validation, to mitigate the risk of XSS attacks.
Conclusion
In conclusion, the Moodle Persistent Cross-site Scripting (XSS) vulnerability allows authenticated users with the Teacher role or higher to inject malicious JavaScript code into the session of another user. This can lead to various security risks, including unauthorized access and data theft. It is crucial to update Moodle to the latest version and implement additional security measures to mitigate the risk of exploitation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for moodle/moodle →
FAQ
Moodle is an open-source learning management system used for online education. It provides a platform for educators to create and manage courses, interact with students, and deliver educational content.
Authenticated users with the Teacher role or higher in Moodle versions up to 3.7.2 are affected by this vulnerability.
The vulnerability allows an attacker to inject malicious JavaScript code into the session of another user. This can lead to unauthorized access, data theft, and privilege escalation.
To fix this vulnerability, it is recommended to update Moodle to version 3.7.3 or later, which includes the necessary security patches.
While there is no specific workaround for this vulnerability, administrators can implement additional security measures, such as limiting user privileges and implementing input validation, to mitigate the risk of XSS attacks.
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
