CVE-2014-0126: Moodle cross-site request forgery (CSRF) vulnerability
Summary
CVE-2014-0126: Moodle cross-site request forgery (CSRF) vulnerability. Affects moodle/moodle across 3 version ranges.
< 2.4.9
>= 2.5.0, < 2.5.5
>= 2.6.0, < 2.6.2
Fixed in 2.4.9, 2.5.5 or 2.6.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning management system (LMS) used by educational institutions to create and manage online courses. It provides a platform for educators to deliver content, interact with students, and assess their progress. Moodle is widely adopted and offers a range of features and plugins to enhance the learning experience. However, a vulnerability has been identified in Moodle versions 2.3.11 through 2.6.2 that allows for cross-site request forgery (CSRF) attacks.
Vulnerability Detail
The CSRF vulnerability exists in the 'enrol/imsenterprise/importnow.php' file in Moodle. This vulnerability allows remote attackers to hijack the authentication of administrators by sending malicious requests that import an IMS Enterprise file. By exploiting this vulnerability, an attacker can perform actions on behalf of an administrator, potentially compromising the integrity and security of the Moodle instance. This vulnerability has a moderate severity rating.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.4.92.4.9composer require moodle/moodle:2.4.9 -
>= 2.5.0, < 2.5.52.5.5composer require moodle/moodle:2.5.5 -
>= 2.6.0, < 2.6.22.6.2composer require moodle/moodle:2.6.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. It is advised to upgrade to a fixed version as mentioned in the 'how_to_fix' section.
Conclusion
The CSRF vulnerability in Moodle versions 2.3.11 through 2.6.2 can allow remote attackers to hijack the authentication of administrators. Upgrading to a fixed version of Moodle (2.4.9, 2.5.5, or 2.6.2) is the recommended solution to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for moodle/moodle →
FAQ
Moodle is an open-source learning management system (LMS) used by educational institutions to create and manage online courses.
A CSRF vulnerability allows an attacker to perform actions on behalf of an authenticated user without their consent or knowledge.
IMS Enterprise is a standard format for exchanging user and enrollment information between systems. Moodle supports importing IMS Enterprise files to manage user enrollment.
This vulnerability has a moderate severity rating.
To protect your Moodle instance, it is recommended to upgrade to a fixed version of Moodle (2.4.9, 2.5.5, or 2.6.2) that addresses the CSRF vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
