CVE-2013-1836: Moodle - Improper Privilege Management in WebDAV Repositories
Summary
CVE-2013-1836: Moodle does not properly manage privileges for WebDAV repositories. Affects moodle/moodle across 3 version ranges.
>= 2.0.0, < 2.2.8
>= 2.3.0, < 2.3.5
>= 2.4.0, < 2.4.2
Fixed in 2.2.8, 2.3.5 or 2.4.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning management system (LMS) used by educational institutions worldwide. It provides a platform for creating and managing online courses, allowing educators to deliver content and engage with students. Moodle supports various features, including the ability to integrate with external repositories through WebDAV. This vulnerability affects Moodle versions 2.x through 2.1.10, 2.2.x before 2.2.8, 2.3.x before 2.3.5, and 2.4.x before 2.4.2.
Vulnerability Detail
The vulnerability in Moodle lies in its improper management of privileges for WebDAV repositories. Remote authenticated users can exploit this flaw to gain unauthorized access to site-wide repositories. By leveraging certain read access, these users can read, modify, or delete arbitrary repositories. This vulnerability poses a moderate risk and can potentially lead to unauthorized data access or manipulation.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 2.0.0, < 2.2.82.2.8composer require moodle/moodle:2.2.8 -
>= 2.3.0, < 2.3.52.3.5composer require moodle/moodle:2.3.5 -
>= 2.4.0, < 2.4.22.4.2composer require moodle/moodle:2.4.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, administrators can disable the use of WebDAV repositories in Moodle until the system is updated to a fixed version. This can be done by modifying the Moodle configuration to remove or disable the WebDAV repository plugin. However, this workaround may limit certain functionalities that rely on WebDAV integration.
Conclusion
The vulnerability in Moodle's privilege management for WebDAV repositories can be mitigated by upgrading to the fixed versions of Moodle. Administrators can also temporarily disable WebDAV repositories until the system is updated. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for moodle/moodle →
FAQ
Moodle is an open-source learning management system used for creating and managing online courses.
Moodle versions 2.x through 2.1.10, 2.2.x before 2.2.8, 2.3.x before 2.3.5, and 2.4.x before 2.4.2 are affected.
Remote authenticated users can exploit this vulnerability by leveraging certain read access to gain unauthorized access to site-wide repositories.
This vulnerability can allow unauthorized users to read, modify, or delete arbitrary repositories, potentially leading to unauthorized data access or manipulation.
A temporary workaround is to disable the use of WebDAV repositories in Moodle until the system is updated to a fixed version.
References
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
