Moodle: cache poisoning via injection into storage

CVE-2024-43428 describes a cache poisoning risk in Moodle that arises from insufficient validation of local storage data [1]. The vulnerability allows an attacker to potentially corrupt cached content by injecting malicious data into the browser's local storage, which Moodle uses for performance optimization.

Exploitation requires the ability to write arbitrary data to the local storage of a user's browser, which could be achieved through cross-site scripting (XSS) or other client-side attacks. No authentication is needed if the attacker can execute JavaScript in the context of the Moodle site, but the attack is limited to the client side.

Successful cache poisoning could lead to the display of manipulated content to users, potentially enabling phishing or other social engineering attacks. The integrity of cached data is compromised, affecting the trustworthiness of the Moodle interface.

Moodle has addressed this issue by adding additional validation checks for local storage data. Users are advised to update to the latest version of Moodle that includes this fix. The vulnerability is documented in the NVD entry [1] and linked to a Red Hat bug tracker.