CVE-2022-35651: Stored XSS and Blind SSRF Vulnerability in Moodle
Summary
CVE-2022-35651: A stored XSS and blind SSRF vulnerability was found in Moodle, occurs due to insufficient sanitization of user-supplied data in the SCORM track details. Affects moodle across 3 version ranges.
>= 3.9.0, < 3.9.15
>= 3.11.0, < 3.11.8
>= 4.0.0, < 4.0.2
Fixed in 3.9.15, 3.11.8 or 4.0.2, depending on the release line you run. How to fix ↓
Also tracked for
- moodle/moodle · Packagist
The same CVE-2022-35651 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning management system (LMS) used by educational institutions to create and deliver online courses. It provides a platform for teachers and students to interact, share resources, and participate in various learning activities. Moodle is widely adopted and offers a range of features, including support for SCORM (Sharable Content Object Reference Model) packages. SCORM is a set of standards that enables the creation of reusable e-learning content. However, a vulnerability has been discovered in Moodle that allows for stored cross-site scripting (XSS) and blind server-side request forgery (SSRF) attacks.
Vulnerability Detail
The vulnerability in Moodle arises from inadequate sanitization of user-supplied data in the SCORM track details. An attacker can exploit this vulnerability by tricking a user into following a specially crafted link. Once clicked, the attacker can execute arbitrary HTML and script code in the victim's browser within the context of the vulnerable Moodle website. This can lead to various malicious activities, including stealing sensitive information, altering the appearance of web pages, and conducting phishing or drive-by-download attacks.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 3.9.0, < 3.9.153.9.15 -
>= 3.11.0, < 3.11.83.11.8 -
>= 4.0.0, < 4.0.24.0.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, administrators can disable the SCORM module in Moodle until the vulnerability is patched. This can be done by navigating to the Site administration menu, selecting Plugins, and then disabling the SCORM module. However, this workaround may impact the functionality of courses that rely on SCORM content, so it is recommended to apply the official fix as soon as possible.
Conclusion
The stored XSS and blind SSRF vulnerability in Moodle can have serious consequences, including the theft of sensitive information and the compromise of user accounts. It is crucial for Moodle administrators to promptly update to the latest fixed version and apply security patches to mitigate the risk. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for moodle →
FAQ
Moodle is an open-source learning management system (LMS) used by educational institutions to create and deliver online courses.
A stored XSS vulnerability allows an attacker to inject malicious code into a web application, which is then stored and executed when accessed by other users.
Blind server-side request forgery (SSRF) is a type of vulnerability where an attacker can make requests to internal resources on a server, potentially leading to information disclosure or further attacks.
An attacker can exploit this vulnerability by tricking a user into clicking a specially crafted link, which then executes arbitrary code in the victim's browser within the context of the vulnerable Moodle website.
Yes, the Moodle development team has released fixed versions that address this vulnerability. It is recommended to update to the latest fixed version and regularly apply security updates provided by the Moodle project.
Related vulnerabilities
Recent vulnerabilities recorded for moodle.
