CVE-2014-0213: Moodle multiple cross-site request forgery (CSRF) vulnerabilities
Summary
CVE-2014-0213: Moodle multiple cross-site request forgery (CSRF) vulnerabilities. Affects moodle/moodle across 3 version ranges.
< 2.4.10
>= 2.5.0, < 2.5.6
>= 2.6.0, < 2.6.3
Fixed in 2.4.10, 2.5.6 or 2.6.3, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning management system (LMS) used by educational institutions to create and manage online courses. It provides a platform for teachers to create assignments and grade student submissions. The Assignment subsystem in Moodle versions 2.3.11, 2.4.x before 2.4.10, 2.5.x before 2.5.6, and 2.6.x before 2.6.3 is vulnerable to multiple cross-site request forgery (CSRF) attacks. These vulnerabilities allow remote attackers to hijack the authentication of teachers for quick-grading requests.
Vulnerability Detail
The CSRF vulnerabilities in Moodle's Assignment subsystem enable attackers to perform unauthorized actions on behalf of authenticated teachers. By tricking a teacher into visiting a malicious website or clicking on a specially crafted link, an attacker can execute actions such as quick-grading requests without the teacher's knowledge or consent. This can lead to unauthorized grade changes, data manipulation, and potential disruption of the learning process.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.4.102.4.10composer require moodle/moodle:2.4.10 -
>= 2.5.0, < 2.5.62.5.6composer require moodle/moodle:2.5.6 -
>= 2.6.0, < 2.6.32.6.3composer require moodle/moodle:2.6.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. It is recommended to apply the available software updates to fix the issue.
Conclusion
Multiple CSRF vulnerabilities have been identified in Moodle's Assignment subsystem, allowing attackers to hijack the authentication of teachers and perform unauthorized actions. It is crucial to upgrade to the fixed versions of Moodle to mitigate these vulnerabilities and ensure the security of the learning management system. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for moodle/moodle →
FAQ
Moodle is an open-source learning management system (LMS) used by educational institutions to create and manage online courses.
A CSRF vulnerability allows an attacker to perform unauthorized actions on behalf of an authenticated user by tricking them into executing malicious requests.
The CSRF vulnerabilities in Moodle can be exploited by tricking a teacher into visiting a malicious website or clicking on a specially crafted link.
The CSRF vulnerabilities in Moodle can lead to unauthorized grade changes, data manipulation, and potential disruption of the learning process.
To fix the CSRF vulnerabilities, it is recommended to upgrade to the fixed versions of Moodle (2.4.10 or later for 2.4.x, 2.5.6 or later for 2.5.x, and 2.6.3 or later for 2.6.x).
References
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
