CVE-2024-28593: Moodle Chat Activity HTML Injection Vulnerability
Summary
CVE-2024-28593: The Chat activity in Moodle 4.3.3 allows students to insert a potentially unwanted HTML A element or IMG element, or HTML content that leads to a performance degradation. Affects moodle versions >= 4.3.3, < 4.3.4. Fixed in 4.3.4. How to fix ↓
Also tracked for
- moodle/moodle · Packagist
The same CVE-2024-28593 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning platform designed to provide educators, administrators, and learners with a single robust, secure, and integrated system to create personalized learning environments. The Chat activity in Moodle allows real-time communication among users, enabling collaborative learning. However, the Chat feature in version 4.3.3 has been found to be vulnerable to HTML injection, which can lead to performance degradation and potential misuse of the platform.
Vulnerability Detail
The vulnerability arises from the Chat activity in Moodle 4.3.3, which permits students to insert potentially unwanted HTML elements, specifically A and IMG tags. This can lead to performance issues as the system may struggle to handle unexpected HTML content. The vendor's documentation indicates that users can utilize HTML code within their messages, which inadvertently opens the door for misuse. This vulnerability is classified as medium severity and can impact the user experience and system performance.
How To Fix
Minimum fixed version
4.3.4
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, administrators can disable the Chat activity or restrict HTML usage in chat messages until the patch is applied. This can be done by modifying the settings in the Moodle administration panel.
Conclusion
The vulnerability identified as CVE-2024-28593 in Moodle's Chat activity poses a risk due to the allowance of unwanted HTML content. It is crucial for users to update to version 4.3.4 or later to mitigate this risk. Additionally, utilizing tools like Vulert can help in monitoring for such vulnerabilities in real-time.
See every vulnerability recorded for moodle →
FAQ
CVE-2024-28593 is a vulnerability in Moodle's Chat activity that allows the injection of unwanted HTML elements, potentially leading to performance issues.
If you are using Moodle version 4.3.3, your installation is affected. You can check your version in the Moodle admin dashboard.
The risks include performance degradation of the Moodle platform and potential misuse of the chat feature by inserting malicious HTML content.
Yes, tools like Vulert can monitor your open-source dependencies for vulnerabilities in real-time using just a manifest file.
If an immediate update is not possible, consider disabling the Chat activity or restricting HTML usage in chat messages as a temporary measure.
Related vulnerabilities
Recent vulnerabilities recorded for moodle.
