CVE-2024-33997: Moodle stored Cross-site Scripting (XSS)
Summary
CVE-2024-33997: Moodle stored Cross-site Scripting (XSS). Affects moodle/moodle across 3 version ranges.
< 4.1.10
>= 4.2.0, < 4.2.7
>= 4.3.0, < 4.3.4
Fixed in 4.1.10, 4.2.7 or 4.3.4, depending on the release line you run. How to fix ↓
Also tracked for
- moodle · Bitnami
The same CVE-2024-33997 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning management system (LMS) used by educational institutions to create and deliver online courses. It provides a platform for educators to manage course materials, interact with students, and facilitate online learning. Moodle is written in PHP and utilizes a modular architecture to support various plugins and extensions. This vulnerability affects the Moodle package and specifically impacts the equation editor feature.
Vulnerability Detail
The vulnerability in Moodle arises from insufficient sanitization of user input when opening the equation editor. This can lead to a stored Cross-site Scripting (XSS) risk when editing another user's equation. An attacker could exploit this vulnerability by injecting malicious code into the equation editor, which would then be executed when viewed by other users. This could potentially allow the attacker to steal sensitive information, perform actions on behalf of the user, or manipulate the content of the affected Moodle instance.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 4.1.104.1.10composer require moodle/moodle:4.1.10 -
>= 4.2.0, < 4.2.74.2.7composer require moodle/moodle:4.2.7 -
>= 4.3.0, < 4.3.44.3.4composer require moodle/moodle:4.3.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, administrators can disable the equation editor feature in Moodle until the package can be updated. This can be done by modifying the configuration settings or disabling the corresponding plugin. However, it is strongly advised to apply the official fix as soon as possible to restore full functionality and mitigate the vulnerability.
Conclusion
The stored Cross-site Scripting (XSS) vulnerability in Moodle's equation editor poses a moderate risk to the security of affected installations. It is crucial to promptly update the Moodle package to the recommended versions or apply the provided workaround to mitigate the vulnerability. Regularly monitoring for security updates and following best practices for secure coding and configuration can help maintain the integrity of Moodle instances. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for moodle/moodle →
FAQ
Moodle is an open-source learning management system (LMS) used by educational institutions to create and deliver online courses.
Cross-site Scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users.
An attacker can exploit this vulnerability by injecting malicious code into the equation editor, which will be executed when viewed by other users.
The consequences of this vulnerability include the potential theft of sensitive information, unauthorized actions performed on behalf of users, and manipulation of Moodle content.
To protect your Moodle instance, it is important to update to the latest version of the Moodle package and regularly apply security patches. Additionally, consider implementing web application firewalls and input validation mechanisms.
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
