CVE-2011-4285: Moodle Incorrect Default Settings
Summary
CVE-2011-4285: Moodle Incorrect Default Settings. Affects moodle/moodle versions >= 2.0, < 2.0.2. Fixed in 2.0.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning management system (LMS) used for creating and managing online courses. It provides various features for educators and learners, including course creation, content management, and collaboration tools. Moodle 2.0.x is a specific version of Moodle that was affected by an incorrect default setting in the moodle/course:delete capability. This vulnerability allowed remote authenticated users with the teacher role to delete arbitrary courses.
Vulnerability Detail
The vulnerability in Moodle 2.0.x stemmed from an incorrect configuration of the moodle/course:delete capability. By default, this capability was set in a way that allowed teachers to delete any course, regardless of their permissions. This meant that a teacher could potentially delete important courses, leading to data loss and disruption of the learning environment. The vulnerability was moderate in severity and had a Common Weakness Enumeration (CWE) ID of CWE-276.
How To Fix
Minimum fixed version
2.0.2
This is the first release that contains the fix.
composer require moodle/moodle:2.0.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended solution is to apply the patch or upgrade to the fixed version of Moodle.
Conclusion
The vulnerability in Moodle 2.0.x allowed teachers to delete arbitrary courses due to an incorrect default setting. To mitigate this vulnerability, users should upgrade to Moodle version 2.0.2 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for moodle/moodle →
FAQ
Users of Moodle 2.0.x versions prior to 2.0.2 are affected by this vulnerability.
An attacker with a teacher role in Moodle could delete any course, potentially causing data loss and disruption to the learning environment.
There is no specific information about known exploits for this vulnerability.
The recommended mitigation is to upgrade to Moodle version 2.0.2 or later, which includes the fix for this vulnerability.
Yes, this vulnerability can be exploited remotely by authenticated users with the teacher role.
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
