CVE-2014-0122: Moodle allows bypass of intended access restrictions
Summary
CVE-2014-0122: Moodle allows bypass of intended access restrictions. Affects moodle/moodle across 3 version ranges.
< 2.4.9
>= 2.5.0, < 2.5.5
>= 2.6.0, < 2.6.2
Fixed in 2.4.9, 2.5.5 or 2.6.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning management system (LMS) used by educational institutions to create and deliver online courses. It provides a platform for educators to manage and organize course materials, interact with students, and facilitate learning activities. Moodle is widely adopted and offers various features such as forums, quizzes, assignments, and chat sessions to enhance the learning experience.
Vulnerability Detail
The vulnerability (CVE-2014-0122) affects Moodle versions through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2. The issue arises in the mod/chat/chat_ajax.php file, where the mod/chat:chat capability is not properly checked during chat sessions. This flaw allows remote authenticated users to bypass intended access restrictions in certain circumstances. Specifically, after an administrator removes the mod/chat:chat capability during a chat session, a user can remain in the session and continue to access restricted functionalities.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.4.92.4.9composer require moodle/moodle:2.4.9 -
>= 2.5.0, < 2.5.52.5.5composer require moodle/moodle:2.5.5 -
>= 2.6.0, < 2.6.22.6.2composer require moodle/moodle:2.6.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. However, administrators can mitigate the risk by closely monitoring user permissions and promptly removing any unauthorized users from chat sessions. Additionally, it is crucial to keep the Moodle installation up to date with the latest security patches.
Conclusion
The vulnerability in Moodle allows authenticated users to bypass access restrictions in chat sessions, potentially compromising the integrity and confidentiality of the system. It is crucial for administrators to apply the recommended security updates and closely monitor user permissions to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for moodle/moodle →
FAQ
Moodle is an open-source learning management system (LMS) used by educational institutions to create and deliver online courses.
The vulnerability affects Moodle versions through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2.
An attacker with authenticated access to Moodle can exploit this vulnerability by remaining in a chat session after an administrator removes their chat capability. This allows the attacker to bypass intended access restrictions and potentially access restricted functionalities.
While there is no specific workaround provided, administrators can mitigate the risk by closely monitoring user permissions and promptly removing any unauthorized users from chat sessions. Keeping the Moodle installation up to date with the latest security patches is also crucial.
To fix this vulnerability, it is recommended to upgrade to the latest version of Moodle available for your branch (2.4.x, 2.5.x, or 2.6.x). The upgraded versions include the necessary patches to address the access restriction bypass issue.
References
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
