CVE-2022-30596: Moodle - Stored XSS Risk in ID Numbers Display
Summary
CVE-2022-30596: A flaw was found in moodle where ID numbers displayed when bulk allocating markers to assignments required additional sanitizing to prevent a stored XSS risk. Affects moodle across 4 version ranges.
>= 3.9.0, < 3.9.14
>= 3.10.0, < 3.10.11
>= 3.11.0, < 3.11.7
>= 4.0.0, < 4.0.1
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- moodle/moodle · Packagist
The same CVE-2022-30596 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning management system widely used for online education. It provides a platform for educators to create and manage courses, assignments, and assessments. Moodle is known for its flexibility, extensibility, and user-friendly interface. However, a vulnerability has been identified in Moodle that exposes a stored cross-site scripting (XSS) risk when displaying ID numbers during bulk allocation of markers to assignments.
Vulnerability Detail
The flaw in Moodle arises from insufficient sanitization of ID numbers, which can be exploited to execute malicious scripts in the context of other users. An attacker could craft a specially crafted ID number that, when displayed, would trigger the execution of arbitrary JavaScript code in the victim's browser. This could lead to various security risks, including session hijacking, data theft, and unauthorized actions on behalf of the victim. The vulnerability affects Moodle versions 3.9.0 to 3.9.14, 3.10.0 to 3.10.11, and 3.11.0 to 3.11.7. Additionally, Moodle 4.0.0 is also impacted.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 3.9.0, < 3.9.143.9.14 -
>= 3.10.0, < 3.10.113.10.11 -
>= 3.11.0, < 3.11.73.11.7 -
>= 4.0.0, < 4.0.14.0.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, administrators can disable the display of ID numbers in the bulk allocation of markers to assignments. This can be achieved by modifying the relevant Moodle configuration settings or by applying a custom code change. However, it is strongly advised to apply the official patch or upgrade to the latest version as soon as possible.
Conclusion
The identified vulnerability in Moodle exposes a stored XSS risk when displaying ID numbers during bulk allocation of markers to assignments. This flaw can be exploited by attackers to execute arbitrary JavaScript code in the context of other users, potentially leading to various security risks. To mitigate this vulnerability, it is crucial to update Moodle to the latest patched version or apply the official fix provided by the Moodle development team. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for moodle →
FAQ
Moodle is an open-source learning management system used for online education. It provides a platform for educators to create and manage courses, assignments, and assessments.
A stored cross-site scripting (XSS) vulnerability is a type of security flaw that allows an attacker to inject malicious scripts into a website or application. These scripts are then executed by unsuspecting users, leading to potential data theft, session hijacking, or unauthorized actions.
The vulnerability affects Moodle versions 3.9.0 to 3.9.14, 3.10.0 to 3.10.11, 3.11.0 to 3.11.7, and 4.0.0.
To fix this vulnerability, it is recommended to update Moodle to the latest patched version available. The Moodle development team has addressed this issue in versions 3.9.14, 3.10.11, 3.11.7, and subsequent releases.
As a temporary workaround, administrators can disable the display of ID numbers in the bulk allocation of markers to assignments. However, it is strongly advised to apply the official patch or upgrade to the latest version as soon as possible.
Related vulnerabilities
Recent vulnerabilities recorded for moodle.
