Executive brief
Moodle, a widely used learning management system, contains a security flaw in its forum component. This vulnerability allows for incorrect handling of data within forum posts, which could potentially allow users to bypass certain content restrictions. This may impact the integrity of information shared within educational forums.
Technical details
An improper input validation vulnerability (CWE-20) exists in Moodle versions 2.x and 3.x. The root cause is incorrect sanitization of attributes within the forum module. A remote, unauthenticated attacker can exploit this over the network to bypass intended restrictions on forum content. While the CVSS score indicates low impact on integrity and no impact on confidentiality or availability, such flaws typically facilitate cross-site scripting (XSS) or other content injection attacks. Patches were released by the vendor to address this sanitization issue.
Affected products
- Moodle Moodle 2.7.0 to 2.7.17, 2.8.0 to 2.8.12, 2.9.0 to 2.9.9, 3.0.0 to 3.0.7, 3.1.0 to 3.1.3, 3.2.0
Timeline
- 2017-01-20: disclosed
- 2017-01-20: advisory