CVE-2011-4279: Moodle Course Profiles Access Control Vulnerability
Summary
CVE-2011-4279: Moodle does not use the forceloginforprofiles setting for course-profiles access control. Affects moodle/moodle versions >= 2.0.0, < 2.0.2. Fixed in 2.0.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning platform designed to provide educators, administrators, and learners with a single robust, secure, and integrated system to create personalized learning environments. It supports a wide range of activities and resources, enabling collaborative learning and course management. However, versions 2.0.x before 2.0.2 have a vulnerability that affects the access control for course profiles, potentially exposing sensitive information.
Vulnerability Detail
The vulnerability arises from Moodle's failure to implement the 'forceloginforprofiles' setting for course profiles, allowing unauthorized access to sensitive information. This oversight can be exploited by remote attackers who utilize search engines to discover exposed course profiles, leading to potential data breaches. The issue is classified under CWE-200 (Information Exposure) and CWE-284 (Improper Access Control), highlighting the severity of the risk associated with this vulnerability.
How To Fix
Minimum fixed version
2.0.2
This is the first release that contains the fix.
composer require moodle/moodle:2.0.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can restrict access to course profiles by modifying the settings in your Moodle configuration. However, the best solution is to update to the patched version as mentioned above.
Conclusion
In summary, CVE-2011-4279 is a significant vulnerability in Moodle that affects course profile access control. It is crucial for users to update to version 2.0.2 or later to mitigate the risks associated with this vulnerability. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for moodle/moodle →
FAQ
CVE-2011-4279 is a vulnerability in Moodle that allows unauthorized access to course profiles due to improper access control settings.
Moodle versions 2.0.x before 2.0.2 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The vulnerability can lead to unauthorized access to sensitive information, which may result in data breaches and privacy violations.
If you cannot update immediately, consider restricting access to course profiles through configuration settings as a temporary measure.
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
