CVE-2014-3551: Moodle/moodle Cross-Site Scripting Vulnerability

LOW
Advisory Identifier: GHSA-m8f5-9wg8-2c3h
Share
CWE-79
Published
Advisory Summary

CVE-2014-3551 is a LOW cross-site scripting vulnerability (CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')) affecting Moodle/moodle libraries in the Packagist ecosystem. The issue involves moodle multiple cross-site scripting (xss) vulnerabilities. Remediation is available by upgrading affected packages to version 2.4.11, 2.5.7, 2.6.4, 2.7.1.

CVE-2014-3551 at a Glance

CVE Identifier CVE-2014-3551
GHSA Identifier GHSA-m8f5-9wg8-2c3h
Severity LOW
CVSS v3.1 Base Score N/A
CWE Classification CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected Product Moodle/moodle
Package Ecosystem Packagist
Published Date
Last Updated

How to Fix CVE-2014-3551

To remediate this vulnerability, upgrade all affected Moodle/moodle dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

moodle/moodle fixed: 2.4.11 
Upgrade moodle/moodle to 2.4.11
moodle/moodle fixed: 2.5.7 
Upgrade moodle/moodle to 2.5.7
moodle/moodle fixed: 2.6.4 
Upgrade moodle/moodle to 2.6.4
moodle/moodle fixed: 2.7.1 
Upgrade moodle/moodle to 2.7.1
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

inspect dependencies for moodle/moodle

How to Check if You Are Affected

To determine whether your application is affected by CVE-2014-3551, inspect your project dependencies for Moodle/moodle:

inspect dependencies for moodle/moodle

Analyze the terminal output to locate any version of Moodle/moodle in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 2.4.11), your application is affected.

Note: Verify declared build manifests and deployed runtime container environments.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), where the product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. In Moodle/moodle, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

Multiple cross-site scripting (XSS) vulnerabilities in the advanced-grading implementation in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allow remote authenticated users to inject arbitrary web script or HTML via a crafted (1) qualification or (2) rating field in a rubric.

CVE-2014-3551 Affected Moodle/moodle Versions

4 component(s)
Fixed Versions:
2.4.112.5.72.6.42.7.1
Product / Package Ecosystem Affected Versions Fixed Version
moodle/moodle
 Packagist
< 2.4.11
2.4.11
moodle/moodle
 Packagist
≥ 2.5.0
< 2.5.7
2.5.7
moodle/moodle
 Packagist
≥ 2.6.0
< 2.6.4
2.6.4
moodle/moodle
 Packagist
≥ 2.7.0
< 2.7.1
2.7.1

References

NVD — CVE-2014-3551 NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-3551
Security Fix Commit FIX COMMIT
https://github.com/moodle/moodle/commit/f25f472be425d6ef8aa587648dafda1bd4d1c5d8
Security Fix Commit FIX COMMIT
https://github.com/moodle/moodle/commit/eb1381de1dbcce0215dcdd62cfac4fe287beed4e
Security Fix Commit FIX COMMIT
https://github.com/moodle/moodle/commit/e42b6e20bdd5d6f09bc09be22fd7f20736e27085
Security Fix Commit FIX COMMIT
https://github.com/moodle/moodle/commit/db5a6e6560c963849f8807184ca32efee6779264
Security Fix Commit FIX COMMIT
https://github.com/moodle/moodle/commit/b5dacb548800ee10d4940c8ebeca48c3c2ae0512
Security Fix Commit FIX COMMIT
https://github.com/moodle/moodle/commit/98d5566c2270e21cbfaf1f4e8d61039f05d6aae2
Security Fix Commit FIX COMMIT
https://github.com/moodle/moodle/commit/8ecc049f7f020086c1881bdf573af16cf2d9f9c9
Security Fix Commit FIX COMMIT
https://github.com/moodle/moodle/commit/8380722bb11f36d33308580aee169e161d3f2c14
Security Fix Commit FIX COMMIT
https://github.com/moodle/moodle/commit/7f4db6f4d9014370df0265ab846ad76235af0cae
Security Fix Commit FIX COMMIT
https://github.com/moodle/moodle/commit/72d1a3ab0b002a9a5f32f3c2b61ffc9fa7f7b789
Security Fix Commit FIX COMMIT
https://github.com/moodle/moodle/commit/68299e6154ae41b7e586904fd1b860cad7f65654
Security Fix Commit FIX COMMIT
https://github.com/moodle/moodle/commit/666248c264642e5ca27601b347fc6913517e2853
Security Fix Commit FIX COMMIT
https://github.com/moodle/moodle/commit/555ee08b17dfe09e02391be137f60fe38c0a7865
Security Fix Commit FIX COMMIT
https://github.com/moodle/moodle/commit/4fc5861cbacdc2f4197faebd3d207d2811e0f09f
Security Fix Commit FIX COMMIT
https://github.com/moodle/moodle/commit/470a466d7f1e0aef030ad2178bbef5a81765c42e
Security Fix Commit FIX COMMIT
https://github.com/moodle/moodle/commit/2c0b608cda12540de79aac0ee6952dda2c8ed947
Security Fix Commit FIX COMMIT
https://github.com/moodle/moodle/commit/1f8eb0842835bcd1ea72b2d2982e0b5c8bc133bb
Moodle/moodle Security Information SECURITY
https://web.archive.org/web/20200228170658/http://www.securityfocus.com/bid/68763
moodle.org/mod/forum/discuss.p... WEB
https://moodle.org/mod/forum/discuss.php?d=264273
Moodle/moodle Source Repository REPOSITORY
https://github.com/moodle/moodle
git.moodle.org/gw WEB
http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-46223
Moodle/moodle Security Information SECURITY
http://openwall.com/lists/oss-security/2014/07/21/1

Frequently Asked Questions

What is CVE-2014-3551?
CVE-2014-3551 is a security vulnerability in Moodle/moodle involving Moodle multiple cross-site scripting (XSS) vulnerabilities under CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting').
Which Moodle/moodle versions are affected?
Affected versions include releases prior to 2.4.11, 2.5.7, 2.6.4, 2.7.1 across affected packages: moodle/moodle.
What version fixes CVE-2014-3551?
Upgrading to 2.4.11, 2.5.7, 2.6.4, 2.7.1 (or the latest patched release for your respective branch) resolves the vulnerability.
Is moodle/moodle affected?
Yes, moodle/moodle is affected in releases prior to 2.4.11, 2.5.7, 2.6.4, 2.7.1. Upgrade your dependency to 2.4.11, 2.5.7, 2.6.4, 2.7.1 or later.
What CWE is associated with CVE-2014-3551?
CVE-2014-3551 is classified under CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.).
How can I check Packagist dependencies for CVE-2014-3551?
Run the dependency tree command: 'inspect dependencies for moodle/moodle'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-m8f5-9wg8-2c3h",
  "modified" : "2024-01-24T21:23:37Z",
  "published" : "2022-05-13T01:12:41Z",
  "aliases" : [ "CVE-2014-3551" ],
  "summary" : "Moodle multiple cross-site scripting (XSS) vulnerabilities",
  "details" : "Multiple cross-site scripting (XSS) vulnerabilities in the advanced-grading implementation in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allow remote authenticated users to inject arbitrary web script or HTML via a crafted (1) qualification or (2) rating field in a rubric.",
  "severity" : [ ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Packagist",
      "name" : "moodle/moodle"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "2.4.11"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Packagist",
      "name" : "moodle/moodle"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "2.5.0"
      }, {
        "fixed" : "2.5.7"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Packagist",
      "name" : "moodle/moodle"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "2.6.0"
      }, {
        "fixed" : "2.6.4"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Packagist",
      "name" : "moodle/moodle"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "2.7.0"
      }, {
        "fixed" : "2.7.1"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2014-3551"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/moodle/moodle/commit/f25f472be425d6ef8aa587648dafda1bd4d1c5d8"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/moodle/moodle/commit/eb1381de1dbcce0215dcdd62cfac4fe287beed4e"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/moodle/moodle/commit/e42b6e20bdd5d6f09bc09be22fd7f20736e27085"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/moodle/moodle/commit/db5a6e6560c963849f8807184ca32efee6779264"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/moodle/moodle/commit/b5dacb548800ee10d4940c8ebeca48c3c2ae0512"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/moodle/moodle/commit/98d5566c2270e21cbfaf1f4e8d61039f05d6aae2"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/moodle/moodle/commit/8ecc049f7f020086c1881bdf573af16cf2d9f9c9"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/moodle/moodle/commit/8380722bb11f36d33308580aee169e161d3f2c14"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/moodle/moodle/commit/7f4db6f4d9014370df0265ab846ad76235af0cae"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/moodle/moodle/commit/72d1a3ab0b002a9a5f32f3c2b61ffc9fa7f7b789"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/moodle/moodle/commit/68299e6154ae41b7e586904fd1b860cad7f65654"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/moodle/moodle/commit/666248c264642e5ca27601b347fc6913517e2853"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/moodle/moodle/commit/555ee08b17dfe09e02391be137f60fe38c0a7865"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/moodle/moodle/commit/4fc5861cbacdc2f4197faebd3d207d2811e0f09f"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/moodle/moodle/commit/470a466d7f1e0aef030ad2178bbef5a81765c42e"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/moodle/moodle/commit/2c0b608cda12540de79aac0ee6952dda2c8ed947"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/moodle/moodle/commit/1f8eb0842835bcd1ea72b2d2982e0b5c8bc133bb"
  }, {
    "type" : "WEB",
    "url" : "https://web.archive.org/web/20200228170658/http://www.securityfocus.com/bid/68763"
  }, {
    "type" : "WEB",
    "url" : "https://moodle.org/mod/forum/discuss.php?d=264273"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/moodle/moodle"
  }, {
    "type" : "WEB",
    "url" : "http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-46223"
  }, {
    "type" : "WEB",
    "url" : "http://openwall.com/lists/oss-security/2014/07/21/1"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-79" ],
    "severity" : "LOW",
    "github_reviewed" : true,
    "github_reviewed_at" : "2024-01-24T21:23:37Z",
    "nvd_published_at" : "2014-07-29T11:10:00Z"
  }
}