CVE-2014-0127: Moodle's time-validation implementation allows bypassing intended restrictions
Summary
CVE-2014-0127: Moodle's time-validation implementation allows bypassing intended restrictions. Affects moodle/moodle across 3 version ranges.
< 2.4.9
>= 2.5.0, < 2.5.5
>= 2.6.0, < 2.6.2
Fixed in 2.4.9, 2.5.5 or 2.6.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Moodle is an open-source learning management system (LMS) used by educational institutions to create and manage online courses. It provides a platform for educators to deliver content, interact with students, and assess their progress. Moodle is widely adopted and offers various features and modules to enhance the learning experience. However, a vulnerability has been identified in Moodle's time-validation implementation, which can allow remote authenticated users to bypass intended restrictions on starting a Feedback activity by choosing an unavailable time.
Vulnerability Detail
The time-validation implementation in Moodle versions 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 contains a flaw that enables remote authenticated users to bypass the intended restrictions on starting a Feedback activity. By exploiting this vulnerability, an attacker can choose an unavailable time, effectively bypassing the restrictions imposed by the system. This can lead to unauthorized access to Feedback activities and potentially compromise the integrity and confidentiality of the learning environment.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.4.92.4.9composer require moodle/moodle:2.4.9 -
>= 2.5.0, < 2.5.52.5.5composer require moodle/moodle:2.5.5 -
>= 2.6.0, < 2.6.22.6.2composer require moodle/moodle:2.6.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to apply the recommended fix by upgrading to the latest version of Moodle.
Conclusion
The identified vulnerability in Moodle's time-validation implementation can allow remote authenticated users to bypass intended restrictions on starting a Feedback activity. To mitigate this risk, it is crucial to upgrade to the latest version of Moodle (2.4.9, 2.5.5, or 2.6.2). This will ensure that the time-validation implementation correctly enforces the intended restrictions and prevents unauthorized access to Feedback activities. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for moodle/moodle →
FAQ
Moodle is an open-source learning management system (LMS) used by educational institutions to create and manage online courses.
This vulnerability allows remote authenticated users to bypass intended restrictions on starting a Feedback activity, potentially compromising the integrity and confidentiality of the learning environment.
Moodle versions 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 are affected by this vulnerability.
To fix this vulnerability, it is recommended to upgrade to Moodle versions 2.4.9, 2.5.5, or 2.6.2.
No, there is no known workaround for this vulnerability. Upgrading to the latest version of Moodle is the recommended solution.
References
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
