CVE-2012-2356: Moodle Authentication Bypass in Question-Bank
Summary
CVE-2012-2356: Moodle Authentication Bypass in Question-Bank. Affects moodle/moodle across 2 version ranges.
>= 2.1, < 2.1.6
>= 2.2, < 2.2.3
Fixed in 2.1.6 or 2.2.3, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning management system (LMS) used by educational institutions to create and manage online courses. It provides various features, including a question-bank functionality that allows instructors to create and store questions for quizzes and assessments. However, versions 2.1.x before 2.1.6 and 2.2.x before 2.2.3 of Moodle are vulnerable to an authentication bypass in the question-bank module.
Vulnerability Detail
The vulnerability in Moodle's question-bank module allows remote authenticated users to bypass the intended capability requirements and save questions via a 'save_question' action. This means that even users without the necessary permissions can save questions to the question bank, potentially compromising the integrity and security of assessments. The vulnerability has a moderate severity rating and is identified by the CVE-2012-2356 identifier.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 2.1, < 2.1.62.1.6composer require moodle/moodle:2.1.6 -
>= 2.2, < 2.2.32.2.3composer require moodle/moodle:2.2.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. It is advised to follow the recommended fix and upgrade to the patched versions of Moodle.
Conclusion
The vulnerability in Moodle's question-bank module allows authenticated users to bypass capability requirements and save questions, potentially compromising the integrity and security of assessments. It is recommended to upgrade to the patched versions of Moodle to fix this vulnerability. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for moodle/moodle →
FAQ
Moodle is an open-source learning management system (LMS) used by educational institutions to create and manage online courses.
The question-bank functionality in Moodle allows instructors to create and store questions for quizzes and assessments.
The vulnerability allows authenticated users to bypass capability requirements and save questions, potentially compromising the integrity and security of assessments.
To fix this vulnerability, upgrade to the recommended versions of Moodle that include patches for the authentication bypass issue.
There is no specific workaround mentioned for this vulnerability. It is advised to follow the recommended fix and upgrade to the patched versions of Moodle.
References
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
