CVE-2024-34006: Moodle Unsanitized HTML in site log for config_log_created
Summary
CVE-2024-34006: Moodle Unsanitized HTML in site log for config_log_created. Affects moodle/moodle across 3 version ranges.
< 4.1.10
>= 4.2.0, < 4.2.7
>= 4.3.0, < 4.3.4
Fixed in 4.1.10, 4.2.7 or 4.3.4, depending on the release line you run. How to fix ↓
Also tracked for
- moodle · Bitnami
The same CVE-2024-34006 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning management system (LMS) used by educational institutions to create and deliver online courses. It provides a platform for educators to manage and organize their courses, interact with students, and track their progress. Moodle is widely used and has a large community of developers contributing to its development and security. However, a vulnerability has been discovered in Moodle that allows unsanitized HTML to be displayed in the site log for config_log_created events.
Vulnerability Detail
The site log report in Moodle did not properly encode event descriptions, leading to the rendering of HTML content instead of displaying it as plaintext. This could allow an attacker to inject malicious HTML code into the event description, potentially leading to cross-site scripting (XSS) attacks. XSS attacks can be used to steal sensitive information, perform unauthorized actions on behalf of the user, or deface the Moodle site. The vulnerability affects versions 4.1.10 to 4.3.0 of the Moodle package.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 4.1.104.1.10composer require moodle/moodle:4.1.10 -
>= 4.2.0, < 4.2.74.2.7composer require moodle/moodle:4.2.7 -
>= 4.3.0, < 4.3.44.3.4composer require moodle/moodle:4.3.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the patches provided by the Moodle development team.
Conclusion
The vulnerability in Moodle that allows unsanitized HTML in the site log for config_log_created events can be mitigated by updating to the latest patched version. It is important to keep your Moodle installation up to date to ensure the security of your online courses and protect against potential cross-site scripting attacks. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for moodle/moodle →
FAQ
Moodle is an open-source learning management system used by educational institutions to create and deliver online courses.
The vulnerability allows for the injection of malicious HTML code, potentially leading to cross-site scripting attacks and unauthorized actions on the Moodle site.
Versions 4.1.10 to 4.3.0 of the Moodle package are affected.
To fix this vulnerability, update your Moodle installation to the latest patched version (4.1.10, 4.2.7, or 4.3.4).
No, there is no known workaround. Applying the patches provided by the Moodle development team is recommended.
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
