Moodle - Insecure Enforcement of forceloginforprofiles Setting

Background

Moodle is an open-source learning management system (LMS) used by educational institutions to create and manage online courses. It provides a platform for educators to deliver content, interact with students, and assess their progress. Moodle is widely adopted and offers a range of features such as course management, user management, grading, and communication tools.

Vulnerability Detail

The vulnerability identified as GHSA-8r7x-qq55-74v2 affects Moodle versions 2.1.10, 2.2.x before 2.2.8, 2.3.x before 2.3.5, and 2.4.x before 2.4.2. The issue resides in the 'user/view.php' file, where the 'forceloginforprofiles' setting is not enforced. This allows remote attackers to access sensitive course-profile information by leveraging the guest role. An attacker can exploit this vulnerability to obtain unauthorized access to course-related data, potentially compromising the privacy and security of users. The vulnerability has been assigned a moderate severity rating.

Workaround

If upgrading to the latest version is not immediately feasible, a temporary workaround can be implemented by manually enforcing the 'forceloginforprofiles' setting in the 'user/view.php' file. This can be achieved by modifying the code to ensure that the setting is properly checked and enforced before allowing access to course-profile information. Here is an example of the modified code:

// Check if forceloginforprofiles is enabled
if ($CFG->forceloginforprofiles) {
    // Enforce login
    require_login();
}

// Rest of the code
// ...

Please note that this workaround is not a permanent solution and should be replaced with the official fix as soon as possible.

Conclusion

The identified vulnerability in Moodle allows unauthorized access to course-profile information, potentially compromising the privacy and security of users. It is crucial to upgrade to the latest version of Moodle or apply the provided workaround to mitigate the risk. For further support and assistance with vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for moodle/moodle →

FAQ