CVE-2014-0217: Moodle does not check for the moodle/course:viewhiddencourses capability
Summary
CVE-2014-0217: Moodle does not check for the moodle/course:viewhiddencourses capability. Affects moodle/moodle versions >= 2.6.0, < 2.6.3. Fixed in 2.6.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning management system (LMS) used by educational institutions to create online courses and manage learning activities. It provides a platform for teachers and students to interact, share resources, and participate in various educational activities. Moodle is widely adopted and offers a range of features to support online learning. However, a vulnerability has been identified in Moodle versions 2.6.x before 2.6.3.
Vulnerability Detail
The vulnerability (CVE-2014-0217) exists in the enrol/index.php file of Moodle. It arises from the lack of proper checks for the moodle/course:viewhiddencourses capability before listing hidden courses. This flaw allows remote attackers, leveraging the guest role, to obtain sensitive name and summary information about these hidden courses by visiting a crafted URL. By exploiting this vulnerability, an attacker can gain unauthorized access to confidential course details, potentially compromising the privacy and security of the affected Moodle instance.
How To Fix
Minimum fixed version
2.6.3
This is the first release that contains the fix.
composer require moodle/moodle:2.6.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround can be implemented by modifying the code in the enrol/index.php file. The following code snippet demonstrates the necessary changes:
// Add the following code before listing the courses
if (!has_capability('moodle/course:viewhiddencourses', $context)) {
// Handle the case when the user does not have the required capability
// Redirect or display an appropriate error message
}
By adding this code, the capability check will be performed before listing hidden courses, preventing unauthorized access to their information.
Conclusion
The vulnerability in Moodle versions 2.6.x before 2.6.3 allows unauthorized access to hidden course information. To mitigate this risk, it is crucial to upgrade Moodle to version 2.6.3 or later, which includes the necessary security patches. Alternatively, the provided workaround can be implemented until the upgrade is performed. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for moodle/moodle →
FAQ
Moodle is an open-source learning management system (LMS) used by educational institutions to create online courses and manage learning activities. It provides a platform for teachers and students to interact, share resources, and participate in various educational activities.
This vulnerability allows remote attackers to obtain sensitive information about hidden courses in Moodle, potentially compromising the privacy and security of the affected Moodle instance.
To fix this vulnerability, it is recommended to upgrade Moodle to version 2.6.3 or later. This version includes the necessary checks for the moodle/course:viewhiddencourses capability, ensuring that hidden courses are not exposed to unauthorized users.
If upgrading to the latest version is not immediately feasible, a temporary workaround can be implemented by modifying the code in the enrol/index.php file. Please refer to the 'workaround' section for detailed instructions.
For more information about this vulnerability, you can refer to the CVE-2014-0217 entry or consult the official Moodle documentation and security advisories.
References
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
