CVE-2013-1835: Moodle's login_as feature leaks information from external repositories
Summary
CVE-2013-1835: Moodle's login_as feature leaks information from external repositories. Affects moodle/moodle across 3 version ranges.
>= 2.0.0, < 2.2.8
>= 2.3.0, < 2.3.5
>= 2.4.0, < 2.4.2
Fixed in 2.2.8, 2.3.5 or 2.4.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning management system (LMS) used by educational institutions worldwide. It provides a platform for creating and managing online courses, allowing administrators to customize the learning environment and track student progress. Moodle supports integration with external repositories, such as cloud storage services, to facilitate file management within courses. However, a vulnerability in Moodle versions 2.x through 2.1.10, 2.2.x before 2.2.8, 2.3.x before 2.3.5, and 2.4.x before 2.4.2 allows remote authenticated administrators to obtain sensitive information from the external repositories of arbitrary users by leveraging the login_as feature.
Vulnerability Detail
The login_as feature in Moodle allows administrators to log in as another user for troubleshooting or support purposes. However, due to a flaw in the implementation, this feature can be abused to access external repositories associated with the user being impersonated. By exploiting this vulnerability, an authenticated administrator can gain unauthorized access to sensitive information stored in external repositories, potentially compromising the privacy and security of users' files. This vulnerability has a low severity rating.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 2.0.0, < 2.2.82.2.8composer require moodle/moodle:2.2.8 -
>= 2.3.0, < 2.3.52.3.5composer require moodle/moodle:2.3.5 -
>= 2.4.0, < 2.4.22.4.2composer require moodle/moodle:2.4.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to a patched version is not immediately feasible, administrators can temporarily disable the login_as feature to prevent exploitation. This can be done by modifying the Moodle configuration or by applying a custom code change. However, disabling the feature may impact troubleshooting and support activities, so it should only be considered as a temporary workaround until the upgrade can be performed.
Conclusion
The vulnerability in Moodle's login_as feature can be mitigated by upgrading to the latest patched version or temporarily disabling the feature. It is crucial for administrators of Moodle installations to take prompt action to protect the privacy and security of users' files. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for moodle/moodle →
FAQ
Moodle is an open-source learning management system (LMS) used by educational institutions to create and manage online courses.
The login_as feature in Moodle allows administrators to log in as another user for troubleshooting or support purposes.
The vulnerability in Moodle's login_as feature allows authenticated administrators to access sensitive information from external repositories associated with the user being impersonated.
The vulnerability can lead to unauthorized access to users' files stored in external repositories, compromising their privacy and security.
To fix this vulnerability, upgrade to the latest patched version of Moodle (2.2.8, 2.3.5, or 2.4.2).
References
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
