Moodle reveals absolute path in exception message
Summary
CVE-2013-1831: Moodle reveals absolute path in exception message. Affects moodle/moodle across 4 version ranges.
< 2.1.10
>= 2.2.0, < 2.2.8
>= 2.3.0, < 2.3.5
>= 2.4.0, < 2.4.2
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning management system (LMS) used by educational institutions to create and deliver online courses. It provides a platform for educators to manage and organize course materials, assessments, and communication with students. Moodle is written in PHP and utilizes a modular architecture that allows for customization and extension through plugins. However, a vulnerability has been discovered in Moodle versions 2.1.10 through 2.4.2 that exposes sensitive information, specifically the absolute path of the server, in an exception message.
Vulnerability Detail
The vulnerability in Moodle arises from a flaw in the lib/setuplib.php file. When an invalid request is made, the system generates an exception message that includes the absolute path of the server. This information can be obtained by remote attackers, potentially aiding them in further attacks or unauthorized access. The vulnerability has been classified as moderate in severity and has been assigned the Common Weakness Enumeration (CWE) ID 200.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.1.102.1.10composer require moodle/moodle:2.1.10 -
>= 2.2.0, < 2.2.82.2.8composer require moodle/moodle:2.2.8 -
>= 2.3.0, < 2.3.52.3.5composer require moodle/moodle:2.3.5 -
>= 2.4.0, < 2.4.22.4.2composer require moodle/moodle:2.4.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, users can mitigate the risk by ensuring that their Moodle installation is not accessible to unauthorized users and by regularly applying security updates.
Conclusion
The vulnerability in Moodle versions 2.1.10 through 2.4.2 exposes the absolute path of the server in an exception message. Users are advised to update their Moodle installation to the latest version available for their branch to mitigate this vulnerability. Regularly applying security updates and ensuring the Moodle installation is secure can also help reduce the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for moodle/moodle →
FAQ
Moodle is an open-source learning management system used by educational institutions to create and deliver online courses.
The vulnerability allows remote attackers to obtain sensitive information, the absolute path of the server, which could aid them in further attacks or unauthorized access.
The vulnerability has been classified as moderate in severity.
To fix this vulnerability, users should update their Moodle installation to the latest version available for their branch.
While no specific workaround is mentioned, users can mitigate the risk by ensuring their Moodle installation is secure and up to date.
References
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
