CVE-2014-0123: Moodle Wiki Subsystem Access Restriction Vulnerability
Summary
CVE-2014-0123: Moodle does not properly restrict access. Affects moodle/moodle across 3 version ranges.
< 2.4.9
>= 2.5.0, < 2.5.5
>= 2.6.0, < 2.6.2
Fixed in 2.4.9, 2.5.5 or 2.6.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning management system (LMS) used for creating and delivering online courses. It provides various features, including a wiki subsystem that allows users to collaboratively create and edit content. The vulnerability in the Moodle wiki subsystem affects versions 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2. This vulnerability allows remote authenticated users with the student role to perform unauthorized wiki operations by exploiting a flaw in access restrictions. Specifically, the view and edit access controls are not properly enforced, enabling an authenticated user to access and modify the individual wiki of any student by leveraging the Recent Activity block.
Vulnerability Detail
The vulnerability arises due to the lack of proper access restriction checks in the Moodle wiki subsystem. By using the Recent Activity block, a remote authenticated user with the student role can bypass the intended access controls and gain unauthorized access to view and edit the individual wiki of any student. This can lead to unauthorized modifications of wiki content, potentially compromising the integrity and confidentiality of the educational material. The vulnerability has a moderate severity rating.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.4.92.4.9composer require moodle/moodle:2.4.9 -
>= 2.5.0, < 2.5.52.5.5composer require moodle/moodle:2.5.5 -
>= 2.6.0, < 2.6.22.6.2composer require moodle/moodle:2.6.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. However, administrators can consider temporarily disabling the affected wiki subsystem or restricting access to it until the Moodle installation can be updated to a fixed version.
Conclusion
The vulnerability in the Moodle wiki subsystem allows remote authenticated users with the student role to perform unauthorized wiki operations. It is recommended to update the Moodle installation to a fixed version to mitigate the risk associated with this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for moodle/moodle →
FAQ
Moodle is an open-source learning management system (LMS) used for creating and delivering online courses. It provides a range of features to facilitate online education.
The wiki subsystem in Moodle allows users to collaboratively create and edit content. It enables students and instructors to contribute to a shared knowledge base.
The vulnerability allows remote authenticated users with the student role to access and modify the individual wiki of any student. This can lead to unauthorized modifications of wiki content and potential compromise of educational material.
The vulnerability has a moderate severity rating.
The vulnerability can be mitigated by updating the Moodle installation to version 2.4.9, 2.5.5, or 2.6.2, which include the necessary fixes. Administrators should ensure they are running a supported and up-to-date version of Moodle.
References
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
