CVE-2012-1157: Moodle default permissions too permissive
Summary
CVE-2012-1157: Moodle default permissions too permissive. Affects moodle/moodle across 4 version ranges.
< 1.9.17
>= 2.0, < 2.0.8
>= 2.1, < 2.1.5
>= 2.2, < 2.2.2
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning management system (LMS) used by educational institutions worldwide. It provides a platform for creating and managing online courses, allowing educators to deliver content and interact with students. Moodle is widely adopted due to its flexibility, extensibility, and robust feature set. However, prior to version 2.2.2, Moodle had a default configuration that allowed all repositories to be viewable by all authenticated users. This default setting posed a security risk as it granted unauthorized access to sensitive course materials and potentially confidential information.
Vulnerability Detail
The vulnerability in Moodle stemmed from its default settings, which allowed all repositories to be accessible by any authenticated user. This meant that any user with a valid account could view and access course materials, even if they were not enrolled in the respective courses. This vulnerability could lead to unauthorized access to sensitive information, compromise the privacy of course content, and potentially expose confidential data. The impact of this vulnerability is moderate, with a CVSS score of 4.3.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.9.171.9.17composer require moodle/moodle:1.9.17 -
>= 2.0, < 2.0.82.0.8composer require moodle/moodle:2.0.8 -
>= 2.1, < 2.1.52.1.5composer require moodle/moodle:2.1.5 -
>= 2.2, < 2.2.22.2.2composer require moodle/moodle:2.2.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, administrators can manually adjust repository permissions to restrict access to enrolled users only. This can be done by navigating to the repository settings in the Moodle administration panel and configuring the appropriate access controls. However, this workaround is not recommended as it requires manual intervention and may be prone to human error. Upgrading to the latest version of Moodle is the recommended long-term solution.
Conclusion
The default permissions vulnerability in Moodle allowed all repositories to be viewable by all authenticated users, potentially compromising the privacy of course content and exposing confidential information. Upgrading to Moodle version 2.2.2 or later and reviewing repository permissions are crucial steps to mitigate this vulnerability. Administrators should ensure they are running the latest version of Moodle and have implemented appropriate access controls. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for moodle/moodle →
FAQ
Moodle is an open-source learning management system (LMS) used by educational institutions to create and manage online courses.
The vulnerability allows unauthorized users to access and view course materials, potentially compromising the privacy of course content and exposing confidential information.
To fix this vulnerability, upgrade to Moodle version 2.2.2 or later and review repository permissions to ensure access is restricted to enrolled users only.
A temporary workaround is to manually adjust repository permissions to restrict access to enrolled users only. However, upgrading to the latest version of Moodle is the recommended solution.
The CVSS score of this vulnerability is 4.3, indicating a moderate impact.
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
