CVE-2024-43437: Moodle Cross-site Scripting Vulnerability
Summary
CVE-2024-43437: Moodle Cross-site Scripting vulnerability. Affects moodle/moodle across 4 version ranges.
< 4.1.12
>= 4.2.0, < 4.2.9
>= 4.3.0, < 4.3.6
>= 4.4.0, < 4.4.2
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- moodle · Bitnami
The same CVE-2024-43437 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning platform designed to provide educators, administrators, and learners with a single robust, secure, and integrated system to create personalized learning environments. It is widely used in educational institutions for course management, content delivery, and student engagement. However, like many web applications, Moodle is susceptible to security vulnerabilities, including cross-site scripting (XSS), which can compromise user data and application integrity.
Vulnerability Detail
A flaw was discovered in Moodle that arises from insufficient sanitization of data during the restoration process. This vulnerability allows attackers to exploit malicious backup files, potentially leading to cross-site scripting (XSS) attacks. Such attacks can enable unauthorized access to user sessions, data theft, or the execution of arbitrary scripts in the context of the user's browser, posing significant risks to user security and privacy.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 4.1.124.1.12composer require moodle/moodle:4.1.12 -
>= 4.2.0, < 4.2.94.2.9composer require moodle/moodle:4.2.9 -
>= 4.3.0, < 4.3.64.3.6composer require moodle/moodle:4.3.6 -
>= 4.4.0, < 4.4.24.4.2composer require moodle/moodle:4.4.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users should avoid restoring backup files from untrusted sources until the update has been applied. Additionally, administrators can implement strict content security policies to mitigate the risk of XSS attacks.
Conclusion
The Moodle cross-site scripting vulnerability (CVE-2024-43437) poses a significant risk to users due to insufficient data sanitization during the restoration of backup files. It is crucial for administrators to update to the latest patched versions to mitigate this risk and ensure the security of their Moodle installations.
See every vulnerability recorded for moodle/moodle →
FAQ
Cross-site scripting (XSS) is a security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users, potentially compromising their data and session.
If you are using Moodle versions prior to 4.4.2, 4.3.6, 4.2.9, or 4.1.12, your installation is vulnerable. You can check your version in the Moodle admin dashboard.
If immediate updates are not possible, avoid using untrusted backup files and consider implementing additional security measures such as content security policies.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using just the composer.lock file. You can check your application against known vulnerabilities without any installation.
The CVSS score for this vulnerability is 5.4, indicating a moderate level of risk associated with the potential exploitation of this flaw.
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
