CVE-2014-0216: Moodle does not properly restrict file access
Summary
CVE-2014-0216: Moodle does not properly restrict file access. Affects moodle/moodle across 3 version ranges.
< 2.4.10
>= 2.5.0, < 2.5.6
>= 2.6.0, < 2.6.3
Fixed in 2.4.10, 2.5.6 or 2.6.3, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning management system (LMS) used by educational institutions worldwide. It provides a platform for creating and managing online courses, allowing educators to deliver content, interact with students, and assess their progress. Moodle is highly customizable and offers various features such as forums, quizzes, assignments, and collaborative tools. However, a vulnerability has been identified in Moodle versions prior to 2.4.10, 2.5.6, and 2.6.3 that could potentially compromise the security of the system.
Vulnerability Detail
The vulnerability, identified as CVE-2014-0216, resides in the My Home implementation of the block_html_pluginfile function in Moodle. This implementation fails to properly restrict file access, enabling remote attackers to obtain sensitive information by visiting an HTML block. By exploiting this vulnerability, an attacker could gain unauthorized access to confidential data stored within the Moodle system, potentially compromising the privacy and integrity of user information.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.4.102.4.10composer require moodle/moodle:2.4.10 -
>= 2.5.0, < 2.5.62.5.6composer require moodle/moodle:2.5.6 -
>= 2.6.0, < 2.6.32.6.3composer require moodle/moodle:2.6.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. It is crucial to apply the recommended fix by upgrading to the patched versions of Moodle.
Conclusion
The identified vulnerability in Moodle versions prior to 2.4.10, 2.5.6, and 2.6.3 could lead to unauthorized access to sensitive information. It is crucial for administrators to upgrade their Moodle installations to the patched versions to mitigate this risk. For further support and assistance in vulnerability remediation, please reach out to DevNack.com.
See every vulnerability recorded for moodle/moodle →
FAQ
Moodle is an open-source learning management system (LMS) used by educational institutions to create and manage online courses.
This vulnerability allows remote attackers to access sensitive information stored within the Moodle system, potentially compromising user privacy and data integrity.
To fix this vulnerability, upgrade your Moodle installation to version 2.4.10, 2.5.6, or 2.6.3, depending on the installed version.
No specific workarounds are available for this vulnerability. It is essential to apply the recommended fix by upgrading Moodle.
For more information, refer to the official Moodle documentation or contact the Moodle support team.
References
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
