CVE-2014-0125: Moodle places a session key in a URL
Summary
CVE-2014-0125: Moodle places a session key in a URL. Affects moodle/moodle across 3 version ranges.
< 2.4.9
>= 2.5.0, < 2.5.5
>= 2.6.0, < 2.6.2
Fixed in 2.4.9, 2.5.5 or 2.6.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning management system (LMS) used by educational institutions to create and manage online courses. It provides a platform for educators to deliver content, interact with students, and track their progress. Moodle is written in PHP and utilizes a database to store course materials, user information, and other relevant data. However, a vulnerability in Moodle versions 2.3.11 to 2.6.2 allows remote attackers to bypass file restrictions in the Alfresco Repository by impersonating a file's owner.
Vulnerability Detail
The vulnerability in Moodle arises from the placement of a session key in a URL. This session key can be exploited by remote attackers to bypass intended file restrictions in the Alfresco Repository. By impersonating the owner of a file, an attacker can gain unauthorized access to files that should be restricted. This can lead to the exposure of sensitive information or the modification of files by unauthorized individuals.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.4.92.4.9composer require moodle/moodle:2.4.9 -
>= 2.5.0, < 2.5.52.5.5composer require moodle/moodle:2.5.5 -
>= 2.6.0, < 2.6.22.6.2composer require moodle/moodle:2.6.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. The recommended solution is to upgrade to a fixed version of Moodle.
Conclusion
The vulnerability in Moodle that allows the session key to be exposed in URLs can be mitigated by upgrading to a fixed version of the software. By doing so, file restrictions in the Alfresco Repository will be properly enforced, preventing unauthorized access and modification of files. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for moodle/moodle →
FAQ
Moodle is an open-source learning management system used by educational institutions to create and manage online courses.
The Alfresco Repository is a component used by Moodle to store and manage files associated with courses.
The vulnerability allows remote attackers to bypass file restrictions in the Alfresco Repository by impersonating a file's owner.
The vulnerability can lead to the exposure of sensitive information or the unauthorized modification of files in the Alfresco Repository.
To fix this vulnerability, it is recommended to upgrade to a fixed version of Moodle (2.4.9, 2.5.5, or 2.6.2).
References
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
