CVE-2019-3850: Moodle Stored HTML in assignment submission comments allowed links to be opened directly
Summary
CVE-2019-3850: Moodle Stored HTML in assignment submission comments allowed links to be opened directly. Affects moodle/moodle across 4 version ranges.
< 3.1.17
>= 3.2.0, < 3.4.8
>= 3.5.0, < 3.5.5
>= 3.6.0, < 3.6.3
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning management system (LMS) used by educational institutions worldwide. It provides a platform for creating and managing online courses, assignments, and assessments. Moodle allows students to submit comments along with their assignment submissions. These comments are stored as HTML and can contain links. However, prior to versions 3.6.3, 3.5.5, 3.4.8, and 3.1.17, links within assignment submission comments would open directly in the same window, making them more susceptible to exploits.
Vulnerability Detail
The vulnerability in Moodle allowed links within assignment submission comments to be opened directly in the same window, without the no-referrer header policy. While the links themselves may be valid, this behavior increased the risk of potential exploits. Attackers could craft malicious links that could lead to phishing attacks, cross-site scripting (XSS), or other forms of exploitation. The lack of the no-referrer header policy made it easier for attackers to track and gather sensitive information from users.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 3.1.173.1.17composer require moodle/moodle:3.1.17 -
>= 3.2.0, < 3.4.83.4.8composer require moodle/moodle:3.4.8 -
>= 3.5.0, < 3.5.53.5.5composer require moodle/moodle:3.5.5 -
>= 3.6.0, < 3.6.33.6.3composer require moodle/moodle:3.6.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, administrators can modify the Moodle code to enforce the no-referrer header policy for links within assignment submission comments. This can be achieved by adding the appropriate header in the code responsible for rendering the comments. Here is an example of how to add the no-referrer header in PHP:
// Add the following code in the appropriate file and location
header('Referrer-Policy: no-referrer');
Please note that applying workarounds directly to the code may require technical expertise and should be thoroughly tested before deployment.
Conclusion
The vulnerability in Moodle versions before 3.6.3, 3.5.5, 3.4.8, and 3.1.17 allowed links within assignment submission comments to be opened directly in the same window, making them more susceptible to exploits. It is crucial to upgrade to the recommended versions or apply the provided workaround to mitigate the risk of potential attacks. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for moodle/moodle →
FAQ
Moodle is an open-source learning management system (LMS) used by educational institutions worldwide. It provides a platform for creating and managing online courses, assignments, and assessments.
This vulnerability allows attackers to craft malicious links that can lead to phishing attacks, cross-site scripting (XSS), or other forms of exploitation. It increases the risk of unauthorized access to sensitive information and potential compromise of user accounts.
Moodle versions before 3.6.3, 3.5.5, 3.4.8, and 3.1.17 are affected by this vulnerability.
To fix this vulnerability, it is recommended to upgrade to Moodle versions 3.6.3, 3.5.5, 3.4.8, or 3.1.17, depending on the installed version. These versions include the necessary fixes to prevent links within assignment submission comments from opening directly in the same window.
As a temporary workaround, administrators can modify the Moodle code to enforce the no-referrer header policy for links within assignment submission comments. This can be achieved by adding the appropriate header in the code responsible for rendering the comments. Please note that applying workarounds directly to the code may require technical expertise and should be thoroughly tested before deployment.
References
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
