CVE-2022-40313: Moodle - Recursive Rendering of Mustache Template Helpers XSS Vulnerability
Summary
CVE-2022-40313: Recursive rendering of Mustache template helpers containing user input could, in some cases, result in an XSS risk or a page failing to load. Affects moodle across 3 version ranges.
>= 3.9.0, < 3.9.17
>= 3.11.0, < 3.11.10
>= 4.0.0, < 4.0.4
Fixed in 3.9.17, 3.11.10 or 4.0.4, depending on the release line you run. How to fix ↓
Also tracked for
- moodle/moodle · Packagist
The same CVE-2022-40313 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning management system (LMS) widely used for creating online courses and educational platforms. It provides various features for course management, content creation, and collaboration. Moodle is developed and maintained by the Moodle Project and has a large user base across educational institutions and organizations. However, a vulnerability has been identified in Moodle that allows for recursive rendering of Mustache template helpers containing user input. This can lead to a cross-site scripting (XSS) risk or cause pages to fail loading.
Vulnerability Detail
The vulnerability in Moodle arises from the recursive rendering of Mustache template helpers that include user input. This can be exploited by an attacker to inject malicious code into the rendered page, potentially leading to cross-site scripting attacks. Additionally, the improper rendering of template helpers can cause pages to fail loading, impacting the user experience. The vulnerability affects Moodle versions 3.9.0 to 3.9.17, 3.11.0 to 3.11.10, and 4.0.0 to 4.0.4.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 3.9.0, < 3.9.173.9.17 -
>= 3.11.0, < 3.11.103.11.10 -
>= 4.0.0, < 4.0.44.0.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users can disable the use of Mustache template helpers that involve user input. This can be achieved by modifying the Moodle configuration to restrict the usage of such helpers. However, this workaround may impact the functionality of certain features that rely on these helpers. It is advised to apply the official patches or upgrade to the fixed versions as soon as possible.
Conclusion
In conclusion, Moodle is vulnerable to a recursive rendering of Mustache template helpers containing user input, which can lead to cross-site scripting (XSS) attacks or page loading failures. It is crucial to update Moodle to the latest patched version or apply the official patches provided by the Moodle Project. Disabling the use of vulnerable template helpers can serve as a temporary workaround, but it is recommended to implement the official fixes as soon as possible. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for moodle →
FAQ
Moodle is an open-source learning management system (LMS) used for creating online courses and educational platforms.
The vulnerability allows for cross-site scripting (XSS) attacks and can cause pages to fail loading.
Moodle versions 3.9.0 to 3.9.17, 3.11.0 to 3.11.10, and 4.0.0 to 4.0.4 are affected.
To fix this vulnerability, update Moodle to the latest patched version (3.9.17, 3.11.10, or 4.0.4).
As a temporary workaround, you can disable the use of Mustache template helpers involving user input.
Related vulnerabilities
Recent vulnerabilities recorded for moodle.
