CVE-2014-0129: Moodle allows attackers to modify the visibility of a badge
Summary
CVE-2014-0129: Moodle allows attackers to modify the visibility of a badge. Affects moodle/moodle across 2 version ranges.
>= 2.5.0, < 2.5.5
>= 2.6.0, < 2.6.2
Fixed in 2.5.5 or 2.6.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning management system (LMS) used for creating and delivering online courses. It provides a platform for educators to create interactive learning environments and engage with students. Moodle offers various features, including the ability to issue badges to recognize achievements or skills. However, a vulnerability in Moodle versions 2.5.x before 2.5.5 and 2.6.x before 2.6.2 allows remote authenticated users to modify the visibility of a badge.
Vulnerability Detail
The vulnerability exists in the 'badges/mybadges.php' file of Moodle. This file fails to properly track the user to whom a badge was issued. As a result, remote authenticated users can exploit this flaw to modify the visibility of any badge, regardless of their own achievements or permissions. The specific vectors through which this vulnerability can be exploited are unspecified. This vulnerability has a moderate severity rating.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 2.5.0, < 2.5.52.5.5composer require moodle/moodle:2.5.5 -
>= 2.6.0, < 2.6.22.6.2composer require moodle/moodle:2.6.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. Users are advised to apply the recommended fix by upgrading to the patched versions of Moodle.
Conclusion
The vulnerability in Moodle allows authenticated users to modify the visibility of badges, potentially impacting the recognition of achievements or skills. Users should upgrade to the patched versions of Moodle to mitigate this vulnerability. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for moodle/moodle →
FAQ
Moodle is an open-source learning management system used for creating and delivering online courses.
Badges in Moodle are used to recognize achievements or skills of students or users.
Users of Moodle versions 2.5.x before 2.5.5 and 2.6.x before 2.6.2 are affected by this vulnerability.
An attacker with authenticated access to Moodle can modify the visibility of any badge, potentially granting or revoking recognition for achievements or skills.
To fix this vulnerability, upgrade your Moodle installation to version 2.5.5 or 2.6.2, depending on your current version.
References
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
