CVE-2024-43439: Moodle H5P Error Message Reflected XSS Vulnerability
Summary
CVE-2024-43439: Moodle reflected XSS via H5P error message. Affects moodle/moodle across 4 version ranges.
< 4.1.12
>= 4.2.0-beta, < 4.2.9
>= 4.3.0-beta, < 4.3.6
>= 4.4.0-beta, < 4.4.2
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- moodle · Bitnami
The same CVE-2024-43439 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning platform designed to provide educators, administrators, and learners with a single robust, secure, and integrated system to create personalized learning environments. It offers a wide range of features including course management, user tracking, and a variety of plugins to enhance functionality. However, Moodle is susceptible to vulnerabilities, such as the reflected XSS risk found in H5P error messages, which can compromise user security.
Vulnerability Detail
A flaw was identified in Moodle related to H5P error messages that lack sufficient sanitization. This oversight allows attackers to inject malicious scripts into the error messages, leading to reflected cross-site scripting (XSS) attacks. When a user interacts with the affected error message, the malicious script can execute in their browser, potentially leading to unauthorized actions or data theft. The vulnerability is classified under CWE-79, which pertains to improper neutralization of input during web page generation.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 4.1.124.1.12composer require moodle/moodle:4.1.12 -
>= 4.2.0-beta, < 4.2.94.2.9composer require moodle/moodle:4.2.9 -
>= 4.3.0-beta, < 4.3.64.3.6composer require moodle/moodle:4.3.6 -
>= 4.4.0-beta, < 4.4.24.4.2composer require moodle/moodle:4.4.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary measure, you can restrict access to the H5P functionality until the update is applied. This can be done by disabling the H5P plugin in the Moodle settings or by limiting user permissions for H5P activities.
Conclusion
The reflected XSS vulnerability in Moodle's H5P error messages poses a significant risk to users. It is crucial to update to the latest patched versions to mitigate this risk. Additionally, utilizing tools like Vulert can help monitor for vulnerabilities in real-time, ensuring a more secure environment for users.
See every vulnerability recorded for moodle/moodle →
FAQ
Reflected XSS is a type of attack where malicious scripts are reflected off a web server, typically via a URL or form submission, and executed in the user's browser.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to analyze your composer.lock file without needing to sign up.
If exploited, this vulnerability can allow attackers to execute scripts in the context of the user's session, potentially leading to data theft, session hijacking, or unauthorized actions on behalf of the user.
While the primary risk is related to unauthorized actions and data theft, there is a potential for data loss if attackers manipulate user sessions or access sensitive information.
If immediate updates are not possible, consider implementing access restrictions to the affected features and monitor your system for any suspicious activity.
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
