CVE-2018-1045

Vulnerability

Moodle versions 3.0 through 3.3.3, 3.2.6 and earlier, 3.1.9 and earlier contain a stored cross-site scripting (XSS) vulnerability in the calendar event name field [1][2]. The application fails to properly sanitize user-supplied input when creating or editing calendar events, allowing arbitrary HTML and JavaScript to be persisted [2].

Exploitation

An attacker with the ability to create or modify calendar events (typically an authenticated user with relevant permissions) can include malicious script code in the event name [2]. No special network position is required beyond access to the Moodle instance; the attack can be carried out via the standard calendar event interface. The injected payload is stored and subsequently executed when other users view the event.

Impact

Successful exploitation leads to stored cross-site scripting, which can result in theft of session cookies, defacement, or other actions performed in the context of the victim's browser session [1][2]. The attacker does not gain elevated server-side privileges directly, but can perform any action the victim user is authorized for.

Mitigation

Moodle has fixed this vulnerability in versions 3.3.4, 3.2.7, and 3.1.10 [2]. Users should upgrade to these or later versions. No workarounds are documented in the available references.