CVE-2010-1616: Moodle - Unauthorized New Accounts Creation
Summary
CVE-2010-1616: Moodle is vulnerable to unauthorized new accounts creation. Affects moodle/moodle across 2 version ranges.
>= 1.8.0, < 1.8.12
>= 1.9.0, < 1.9.8
Fixed in 1.8.12 or 1.9.8, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning management system (LMS) used for creating and delivering online courses. It provides a platform for educators to create interactive learning environments and engage with students. Moodle versions 1.8.x and 1.9.x are affected by a vulnerability that allows unauthorized creation of new accounts. This vulnerability arises when restoring a course, enabling teachers to create new accounts even without the necessary permissions.
Vulnerability Detail
The vulnerability in Moodle versions 1.8.x and 1.9.x allows teachers to create new roles during the course restoration process. This capability bypasses the moodle/user:create capability check, enabling unauthorized account creation. As a result, teachers can create new accounts without proper authorization, potentially leading to unauthorized access and misuse of the Moodle system.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 1.8.0, < 1.8.121.8.12composer require moodle/moodle:1.8.12 -
>= 1.9.0, < 1.9.81.9.8composer require moodle/moodle:1.9.8
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, users can mitigate the risk by ensuring that only trusted and authorized teachers have access to the course restoration functionality. Regularly monitoring and auditing user accounts can also help identify any unauthorized accounts created.
Conclusion
The vulnerability in Moodle versions 1.8.x and 1.9.x allows unauthorized creation of new accounts during course restoration. Upgrading to the recommended versions (1.8.12 and 1.9.8) will address this vulnerability. Regular monitoring and auditing of user accounts can also help identify any unauthorized accounts. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for moodle/moodle →
FAQ
Moodle is an open-source learning management system (LMS) used for creating and delivering online courses. It provides a platform for educators to create interactive learning environments and engage with students.
Moodle versions 1.8.x and 1.9.x are affected by this vulnerability.
This vulnerability allows unauthorized creation of new accounts in Moodle, potentially leading to unauthorized access and misuse of the system.
To fix this vulnerability, it is recommended to upgrade to Moodle version 1.8.12 for Moodle 1.8.x users and version 1.9.8 for Moodle 1.9.x users.
While no specific workaround is mentioned, users can mitigate the risk by ensuring only trusted and authorized teachers have access to the course restoration functionality.
References
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
