CVE-2011-4301: Moodle Allows Modification of Constants
Summary
CVE-2011-4301: Moodle Allows Modification of Constants. Affects moodle/moodle across 3 version ranges.
< 1.9.14
>= 2.0, < 2.0.5
>= 2.1, < 2.1.2
Fixed in 1.9.14, 2.0.5 or 2.1.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning management system (LMS) used for creating and delivering online courses. It provides a wide range of features and functionalities to facilitate online education. The MoodleQuickForm class in the Forms Library, specifically in lib/formslib.php, is responsible for handling form-related operations within Moodle. However, versions 1.9.x before 1.9.14, 2.0.x before 2.0.5, and 2.1.x before 2.1.2 suffer from a vulnerability that allows remote attackers to modify constant fields, leading to unexpected form content submission.
Vulnerability Detail
The vulnerability arises due to the lack of recognition of Forms API setConstant operations by the MoodleQuickForm class. This allows attackers to manipulate the values of constant fields in forms. By modifying these values, attackers can submit unexpected form content, potentially bypassing intended restrictions or injecting malicious data. The impact of this vulnerability can vary depending on the specific usage of forms within Moodle, but it has the potential to undermine the integrity and security of form submissions.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.9.141.9.14composer require moodle/moodle:1.9.14 -
>= 2.0, < 2.0.52.0.5composer require moodle/moodle:2.0.5 -
>= 2.1, < 2.1.22.1.2composer require moodle/moodle:2.1.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. However, users can mitigate the risk by ensuring they are running one of the fixed versions mentioned above. Additionally, implementing proper input validation and sanitization measures can help minimize the impact of potential form content manipulation.
Conclusion
The vulnerability in Moodle that allows modification of constants in forms can have significant implications for the integrity and security of form submissions. It is crucial to update to the fixed versions mentioned above to address this vulnerability. Additionally, implementing proper input validation and sanitization practices can further enhance the security of form handling within Moodle. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for moodle/moodle →
FAQ
Moodle is an open-source learning management system (LMS) used for creating and delivering online courses.
The Forms Library in Moodle is responsible for handling form-related operations within the system.
The vulnerability allows remote attackers to modify constant fields in forms, potentially leading to unexpected form content submission.
To fix this vulnerability, it is recommended to update Moodle to the latest fixed version.
There are no specific workarounds provided for this vulnerability, but implementing proper input validation and sanitization measures can help mitigate the risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
