CVE-2006-4936: Moodle does not properly validate module instance id
Summary
CVE-2006-4936: Moodle does not properly validate module instance id. Affects moodle/moodle versions < 1.6.2. Fixed in 1.6.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning management system (LMS) used for creating and delivering online courses. It provides a platform for educators to create interactive and engaging learning experiences for students. Moodle is widely adopted in educational institutions and organizations worldwide. However, prior to version 1.6.2, Moodle had a vulnerability that allowed for improper validation of the module instance id when creating a course module object. This vulnerability could be exploited by remote attackers, although the specific impact is unspecified.
Vulnerability Detail
The vulnerability in Moodle arises from the lack of proper validation of the module instance id during the creation of a course module object. This oversight opens up the possibility of remote attacks, although the exact consequences are not specified. The vulnerability is assigned the CVE identifier CVE-2006-4936 and has a moderate severity rating. The Common Weakness Enumeration (CWE) identifier associated with this vulnerability is CWE-20.
How To Fix
Minimum fixed version
1.6.2
This is the first release that contains the fix.
composer require moodle/moodle:1.6.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended course of action is to apply the available update to Moodle.
Conclusion
In conclusion, Moodle versions prior to 1.6.2 are vulnerable to a module instance id validation issue. This vulnerability could potentially be exploited by remote attackers. It is recommended to update Moodle to version 1.6.2 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for moodle/moodle →
FAQ
Moodle is an open-source learning management system used for creating and delivering online courses.
The impact of this vulnerability is unspecified, but it has the potential to be exploited by remote attackers.
This vulnerability has a moderate severity rating.
The CVE identifier for this vulnerability is CVE-2006-4936.
To fix this vulnerability, update Moodle to version 1.6.2 or later.
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
