CVE-2014-2572: Moodle - Attackers can modify grade metadata
Summary
CVE-2014-2572: Moodle attackers to modify grade metadata. Affects moodle/moodle versions >= 2.6.0, < 2.6.2. Fixed in 2.6.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning management system (LMS) used by educational institutions to create and deliver online courses. It provides a platform for teachers to manage assignments, quizzes, and grades, and for students to access course materials and submit their work. Moodle is widely used and offers various features to facilitate online learning.
Vulnerability Detail
The vulnerability identified as CVE-2014-2572 affects Moodle versions 2.6.x prior to 2.6.2. The issue resides in the 'mod/assign/externallib.php' file, which handles assignment web-service parameters. Due to improper handling of these parameters, remote authenticated users can exploit this vulnerability to modify grade metadata through unspecified vectors. This could potentially lead to unauthorized grade changes and manipulation of student records.
How To Fix
Minimum fixed version
2.6.2
This is the first release that contains the fix.
composer require moodle/moodle:2.6.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. It is essential to apply the recommended fix by upgrading to Moodle version 2.6.2 or later.
Conclusion
The vulnerability in Moodle versions 2.6.x prior to 2.6.2 allows authenticated users to modify grade metadata, potentially compromising the integrity of student records. It is crucial to upgrade to Moodle version 2.6.2 or later to mitigate this vulnerability. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for moodle/moodle →
FAQ
Moodle is an open-source learning management system (LMS) used for online course management and delivery.
The vulnerability allows authenticated users to modify grade metadata, potentially leading to unauthorized grade changes and manipulation of student records.
Moodle versions 2.6.x prior to 2.6.2 are affected by this vulnerability.
To fix this vulnerability, upgrade Moodle to version 2.6.2 or later.
No, there is no specific workaround available. Upgrading to the latest version is the recommended solution.
References
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
