Description
Moodle LMS 4.0 contains a cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by submitting payloads through the search parameter. Attackers can inject JavaScript code via the search field in course/search.php to execute arbitrary scripts in users' browsers and steal session cookies.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Moodle | Moodle LMS | 4.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 18.04 LTS | moodle | No fix yet | — |
| Ubuntu Pro 16.04 LTS | moodle | No fix yet | — |
References
- ExploitDB-51115 exploit
- Official Product Homepage product
- Product Reference product
- VulnCheck Advisory: Moodle LMS 4.0 Cross-Site Scripting via course search.php third-party-advisory