CVE-2013-1832: Moodle WebDAV Password Disclosure
Summary
CVE-2013-1832: Moodle includes the WebDAV password in the configuration form. Affects moodle/moodle across 4 version ranges.
>= 2.0.0, <= 2.1.10
>= 2.2.0, < 2.2.8
>= 2.3.0, < 2.3.5
>= 2.4.0, < 2.4.2
Fixed in 2.2.8, 2.3.5 or 2.4.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning management system (LMS) used by educational institutions worldwide. It provides a platform for creating and managing online courses, allowing educators to deliver content, engage with students, and assess their progress. Moodle supports various plugins and repositories, including WebDAV, which enables users to access and manage files remotely.
The WebDAV repository in Moodle versions 2.x through 2.1.10, 2.2.x before 2.2.8, 2.3.x before 2.3.5, and 2.4.x before 2.4.2 is vulnerable to a security issue that exposes the WebDAV password in the configuration form. This vulnerability can be exploited by remote authenticated administrators to obtain sensitive information by configuring an instance.
Vulnerability Detail
The vulnerability in Moodle's WebDAV repository arises from the inclusion of the WebDAV password in the configuration form. This means that remote authenticated administrators can access the password by configuring an instance. By obtaining the WebDAV password, an attacker could potentially gain unauthorized access to files and resources stored in the WebDAV repository, compromising the confidentiality and integrity of the system.
This vulnerability has a moderate severity rating and is classified under CWE-200 (Information Exposure).
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 2.2.0, < 2.2.82.2.8composer require moodle/moodle:2.2.8 -
>= 2.3.0, < 2.3.52.3.5composer require moodle/moodle:2.3.5 -
>= 2.4.0, < 2.4.22.4.2composer require moodle/moodle:2.4.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by upgrading to a patched version of Moodle.
Conclusion
The WebDAV password disclosure vulnerability in Moodle can lead to unauthorized access to sensitive files and resources. It is crucial for Moodle administrators to upgrade to the latest patched version to mitigate this risk. For further assistance and support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for moodle/moodle →
FAQ
Moodle is an open-source learning management system (LMS) used by educational institutions to create and manage online courses.
The WebDAV repository is a plugin in Moodle that allows users to access and manage files remotely using the WebDAV protocol.
This vulnerability exposes the WebDAV password in the configuration form, potentially allowing unauthorized access to files and resources stored in the WebDAV repository.
To fix this vulnerability, it is recommended to upgrade to a patched version of Moodle.
There is no known workaround for this vulnerability. Upgrading to a patched version of Moodle is the recommended solution.
References
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
