CVE-2024-34006: Moodle Unsanitized HTML in Site Log Event Descriptions
Summary
CVE-2024-34006: moodle: unsanitized HTML in site log for config_log_created. Affects moodle across 3 version ranges.
< 4.1.10
>= 4.2.0, < 4.2.7
>= 4.3.0, < 4.3.4
Fixed in 4.1.10, 4.2.7 or 4.3.4, depending on the release line you run. How to fix ↓
Also tracked for
- moodle/moodle · Packagist
The same CVE-2024-34006 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning platform designed to provide educators, administrators, and learners with a single robust, secure, and integrated system to create personalized learning environments. It offers features such as course management, user management, and reporting tools. However, it is susceptible to vulnerabilities that can compromise the integrity of its logging system, particularly regarding how event descriptions are rendered.
Vulnerability Detail
The vulnerability arises from the lack of proper encoding for HTML content in the site log event descriptions. This oversight allows for unsanitized HTML to be displayed, which can lead to security issues such as Cross-Site Scripting (XSS) attacks. Attackers could exploit this vulnerability to inject malicious scripts that may execute in the context of the user's browser, potentially leading to data theft or unauthorized actions.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 4.1.104.1.10 -
>= 4.2.0, < 4.2.74.2.7 -
>= 4.3.0, < 4.3.44.3.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users can manually sanitize the event descriptions before they are logged. This can be done by implementing a function that encodes HTML entities in the event descriptions before they are saved to the log. Example code snippet:
function sanitizeLogDescription($description) {
return htmlspecialchars($description, ENT_QUOTES, 'UTF-8');
}
$sanitizedDescription = sanitizeLogDescription($eventDescription);
Conclusion
In summary, CVE-2024-34006 presents a significant risk to Moodle installations due to unsanitized HTML in site log event descriptions. It is crucial for users to update to the latest patched versions to mitigate this vulnerability and protect their systems from potential attacks.
See every vulnerability recorded for moodle →
FAQ
CVE-2024-34006 is a vulnerability in Moodle that allows unsanitized HTML to be displayed in site log event descriptions, potentially leading to XSS attacks.
If you are using Moodle versions prior to 4.1.10, 4.2.7, or 4.3.4, your installation may be vulnerable. You can check your version in the admin dashboard.
The main risk is the potential for XSS attacks, where an attacker can inject malicious scripts that could compromise user data and session integrity.
Yes, tools like Vulert can monitor your application for open-source vulnerabilities in real-time using just a manifest file. You can check your application using the Vulert playground without signup.
If an immediate update is not possible, implement the provided workaround to sanitize log descriptions until you can upgrade to a secure version.
References
Related vulnerabilities
Recent vulnerabilities recorded for moodle.
