Stored XSS vulnerability in Moodle
Summary
CVE-2024-38274: Moodle stored XSS via calendar's event title when deleting the event. Affects moodle/moodle across 4 version ranges.
< 4.1.11
>= 4.2.0-beta, < 4.2.8
>= 4.3.0-beta, < 4.3.5
>= 4.4.0-beta, < 4.4.1
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- moodle · Bitnami
The same CVE-2024-38274 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning management system (LMS) used by educational institutions to create and manage online courses. It provides various features such as course management, user management, and collaboration tools. Moodle is written in PHP and relies on a database backend for data storage. The vulnerability in question affects the calendar functionality of Moodle.
Vulnerability Detail
The stored XSS vulnerability in Moodle's calendar arises from insufficient escaping of event titles when deleting an event. This allows an attacker to inject malicious code into the event title, which is not properly sanitized before being displayed in the event deletion prompt. When a user attempts to delete the event, the injected code gets executed in the context of the victim's browser, potentially leading to unauthorized actions or data theft. The severity of this vulnerability is considered moderate, with a CVSS score of 6.1.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 4.1.114.1.11composer require moodle/moodle:4.1.11 -
>= 4.2.0-beta, < 4.2.84.2.8composer require moodle/moodle:4.2.8 -
>= 4.3.0-beta, < 4.3.54.3.5composer require moodle/moodle:4.3.5 -
>= 4.4.0-beta, < 4.4.14.4.1composer require moodle/moodle:4.4.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, you can disable the calendar functionality in Moodle until the patch is applied. This can be done by modifying the configuration settings or by restricting access to the calendar feature for affected users.
Conclusion
The stored XSS vulnerability in Moodle's calendar poses a moderate risk to the security of the application. It is crucial to apply the provided patches or upgrade to the latest version to mitigate this vulnerability. Additionally, developers should follow secure coding practices and properly sanitize user input to prevent similar vulnerabilities in the future. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for moodle/moodle →
FAQ
Moodle is an open-source learning management system used for creating and managing online courses.
A stored XSS vulnerability allows an attacker to inject malicious code into a web application, which is then stored and executed when accessed by other users.
The stored XSS vulnerability in Moodle's calendar can lead to unauthorized actions, data theft, or the execution of malicious code in the context of a victim's browser.
To fix this vulnerability, you should upgrade to the latest patched version of Moodle and ensure proper input sanitization and escaping in your code.
Yes, you can temporarily disable the calendar functionality in Moodle until the patch is applied.
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
