CVE-2024-29374: Cross-Site Scripting in Moodle
Summary
CVE-2024-29374: Cross site scripting in moodle. Affects moodle/moodle versions < 3.10.9. No fix is published. How to fix ↓
Also tracked for
- moodle · Bitnami
The same CVE-2024-29374 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning management system (LMS) used by educational institutions and organizations to create online courses and manage learning activities. It provides a platform for teachers and students to interact, share resources, and participate in various educational activities. Moodle is widely adopted and offers a range of features to support online learning. However, version 3.10.9 of Moodle is vulnerable to a Cross-Site Scripting (XSS) attack.
Vulnerability Detail
The Cross-Site Scripting (XSS) vulnerability in Moodle 3.10.9 is caused by improper handling of user input within the "GET /?lang=" URL parameter. An attacker can exploit this vulnerability by injecting malicious code into the URL parameter, which is then executed by the victim's browser. This can lead to various consequences, including unauthorized access to sensitive information, session hijacking, and potential remote code execution. The severity of this vulnerability is rated as MODERATE with a CVSS score of 6.1.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can implement input validation and output encoding to mitigate the risk of XSS attacks. This involves sanitizing user input and encoding output to prevent the execution of malicious scripts. However, this workaround may not provide complete protection and should be considered a temporary measure until the software is updated.
Conclusion
The Cross-Site Scripting (XSS) vulnerability in Moodle 3.10.9 exposes users to potential security risks, including unauthorized access and remote code execution. It is crucial for users to update their Moodle installations to the latest version and implement appropriate security measures to mitigate the risk of exploitation.
See every vulnerability recorded for moodle/moodle →
FAQ
Moodle is an open-source learning management system used for creating online courses and managing educational activities.
Cross-Site Scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users.
The XSS vulnerability in Moodle can lead to unauthorized access to sensitive information, session hijacking, and potential remote code execution.
The severity of this vulnerability is rated as MODERATE with a CVSS score of 6.1.
Users should update their Moodle installations to the latest patched version and follow best practices for input validation and output encoding.
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
