VYPR
← All advisories
Moderate severityNVD Advisory· Published Sep 17, 2018· Updated Aug 5, 2024

CVE-2018-14631

CVE-2018-14631

Description

Reflected XSS in Moodle Boost theme's blog search breadcrumb navigation allows attackers to execute arbitrary JavaScript via crafted search parameter.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Reflected XSS in Moodle Boost theme's blog search breadcrumb navigation allows attackers to execute arbitrary JavaScript via crafted search parameter.

Vulnerability

A reflected cross-site scripting (XSS) vulnerability exists in the Boost theme of Moodle versions prior to 3.5.2, 3.4.5, and 3.3.8. The breadcrumb navigation displayed when showing blog search results does not properly filter the search GET parameter, allowing injection of arbitrary HTML and JavaScript [1][2].

Exploitation

An attacker can craft a malicious URL containing JavaScript in the search parameter (e.g., ?search=). If a logged-in user follows such a link, the injected script executes in the context of the victim's session. No authentication or special privileges are required beyond the victim clicking the link [1][2].

Impact

Successful exploitation leads to reflected XSS, enabling the attacker to execute arbitrary JavaScript in the victim's browser. This can result in session hijacking, defacement, or theft of sensitive information displayed on the page. The attack is limited to the scope of the user's session and the Moodle instance [1][2].

Mitigation

Moodle has released fixed versions: 3.5.2, 3.4.5, and 3.3.8. Users should upgrade to these versions or later. No workaround is documented; the only mitigation is applying the patch [1][2].

References
  1. NVD - CVE-2018-14631
  2. 1629937 – (CVE-2018-14631) CVE-2018-14631 moodle: boost theme

AI Insight generated on May 22, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
moodle/moodlePackagist
>= 3.3, < 3.3.83.3.8
moodle/moodlePackagist
>= 3.4, < 3.4.53.4.5
moodle/moodlePackagist
>= 3.5, < 3.5.23.5.2

Affected products

1

Patches

3
bd27666c42be

Moodle release 3.5.2

https://github.com/moodle/moodleEloy Lafuente (stronk7)Sep 8, 2018via osv
commit
1 file changed · +2 −2
  • version.php+2 −2 modified
    @@ -29,11 +29,11 @@
 
 defined('MOODLE_INTERNAL') || die();
 
-$version  = 2018051701.11;              // 20180517      = branching date YYYYMMDD - do not modify!
+$version  = 2018051702.00;              // 20180517      = branching date YYYYMMDD - do not modify!
                                         //         RR    = release increments - 00 in DEV branches.
                                         //           .XX = incremental changes.
 
-$release  = '3.5.1+ (Build: 20180907)'; // Human-friendly version name
+$release  = '3.5.2 (Build: 20180910)'; // Human-friendly version name
 
 $branch   = '35';                       // This version's branch.
 $maturity = MATURITY_STABLE;             // This version's maturity level.
28f6460de388

Moodle release 3.4.5

https://github.com/moodle/moodleEloy Lafuente (stronk7)Sep 8, 2018via osv
commit
1 file changed · +2 −2
  • version.php+2 −2 modified
    @@ -29,11 +29,11 @@
 
 defined('MOODLE_INTERNAL') || die();
 
-$version  = 2017111304.11;              // 20171113      = branching date YYYYMMDD - do not modify!
+$version  = 2017111305.00;              // 20171113      = branching date YYYYMMDD - do not modify!
                                         //         RR    = release increments - 00 in DEV branches.
                                         //           .XX = incremental changes.
 
-$release  = '3.4.4+ (Build: 20180907)'; // Human-friendly version name
+$release  = '3.4.5 (Build: 20180910)'; // Human-friendly version name
 
 $branch   = '34';                       // This version's branch.
 $maturity = MATURITY_STABLE;             // This version's maturity level.
c37329dc1063

Moodle release 3.3.8

https://github.com/moodle/moodleEloy Lafuente (stronk7)Sep 8, 2018via osv
commit
1 file changed · +2 −2
  • version.php+2 −2 modified
    @@ -29,11 +29,11 @@
 
 defined('MOODLE_INTERNAL') || die();
 
-$version  = 2017051507.07;              // 20170515      = branching date YYYYMMDD - do not modify!
+$version  = 2017051508.00;              // 20170515      = branching date YYYYMMDD - do not modify!
                                         //         RR    = release increments - 00 in DEV branches.
                                         //           .XX = incremental changes.
 
-$release  = '3.3.7+ (Build: 20180907)'; // Human-friendly version name
+$release  = '3.3.8 (Build: 20180910)'; // Human-friendly version name
 
 $branch   = '33';                       // This version's branch.
 $maturity = MATURITY_STABLE;             // This version's maturity level.

Vulnerability mechanics

Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

5

News mentions

0

No linked articles in our index yet.