CVE-2024-33998: Moodle Cross-site Scripting (XSS)
Summary
CVE-2024-33998: Moodle Cross-site Scripting (XSS). Affects moodle/moodle across 3 version ranges.
< 4.1.10
>= 4.2.0, < 4.2.7
>= 4.3.0, < 4.3.4
Fixed in 4.1.10, 4.2.7 or 4.3.4, depending on the release line you run. How to fix ↓
Also tracked for
- moodle · Bitnami
The same CVE-2024-33998 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning management system (LMS) used by educational institutions to create and manage online courses. It provides a platform for educators to deliver content, interact with students, and assess their progress. Moodle is widely adopted and offers various features such as discussion forums, quizzes, and assignment submissions. However, a vulnerability has been identified in Moodle that could potentially allow for cross-site scripting (XSS) attacks.
Vulnerability Detail
The vulnerability in Moodle arises from insufficient escaping of participants' names in the participants page table. This can lead to a stored XSS risk when interacting with certain features. An attacker could exploit this vulnerability by injecting malicious scripts into the participants' names, which would then be executed when viewed by other users. This could result in unauthorized access to sensitive information, session hijacking, or the manipulation of user data.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 4.1.104.1.10composer require moodle/moodle:4.1.10 -
>= 4.2.0, < 4.2.74.2.7composer require moodle/moodle:4.2.7 -
>= 4.3.0, < 4.3.44.3.4composer require moodle/moodle:4.3.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. However, administrators can mitigate the risk by disabling the display of participants' names in the affected features or by implementing input validation and output encoding to prevent the execution of malicious scripts.
Conclusion
The identified vulnerability in Moodle poses a moderate risk due to the potential for cross-site scripting attacks. It is crucial for administrators to update to the latest version of Moodle and apply security patches to protect against this vulnerability. Regular monitoring and proactive security measures are recommended to ensure the integrity and safety of Moodle installations.
See every vulnerability recorded for moodle/moodle →
FAQ
Moodle is an open-source learning management system used by educational institutions to create and manage online courses.
Cross-site scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users.
This vulnerability in Moodle allows for the execution of malicious scripts through insufficient escaping of participants' names, potentially leading to unauthorized access or data manipulation.
To fix this vulnerability, update Moodle to the latest version (4.3.4 or 4.2.7) and regularly apply security patches. This will ensure proper escaping of participants' names and mitigate the risk of XSS attacks.
While there is no specific workaround provided, administrators can mitigate the risk by disabling the display of participants' names or implementing input validation and output encoding.
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
