CVE-2017-2645: Moodle XSS in attachments to evidence of prior learning
6.1
CVSS Score
3.0
Basic Information
CVE ID
GHSA ID
EPSS Score
0.51563%
CWE
Published
5/17/2022
Updated
4/24/2024
KEV Status
No
Technology
PHP
PHPTechnical Details
CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| moodle/moodle | composer | >= 3.1, < 3.1.5 | 3.1.5 |
| moodle/moodle | composer | >= 3.2, < 3.2.2 | 3.2.2 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The vulnerability stems from improper handling of file downloads in Moodle's file serving mechanism. The advisory explicitly states XSS occurred because attachments were opened in the current Moodle session instead of being forced to download. The send_stored_file function in Moodle's core file handling library (lib/filelib.php) is responsible for sending files with headers. The lack of forced download headers (Content-Disposition: attachment) for these specific attachments would allow HTML/JS files to execute in the victim's browser. This matches the XSS pattern described in CWE-79 and aligns with the security notice mentioning the fix involved forcing downloads for these attachments.