CVE-2014-3541: Moodle vulnerable to PHP object injection attacks
Summary
CVE-2014-3541: Moodle vulnerable to PHP object injection attacks. Affects moodle/moodle across 4 version ranges.
< 2.4.11
>= 2.5.0, < 2.5.7
>= 2.6.0, < 2.6.4
>= 2.7.0, < 2.7.1
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning management system (LMS) used by educational institutions to create online courses and manage learning content. It provides a platform for educators to deliver instructional materials, engage with students, and track their progress. Moodle is written in PHP and utilizes various components to enhance its functionality. One such component is the Repositories module, which allows users to access and manage external resources within Moodle. However, versions of Moodle prior to 2.4.11, 2.5.7, 2.6.4, and 2.7.1 are vulnerable to PHP object injection attacks through serialized data associated with an add-on.
Vulnerability Detail
The vulnerability in Moodle allows remote attackers to exploit PHP object injection and execute arbitrary code. By manipulating serialized data associated with an add-on, an attacker can inject malicious PHP objects into the application's code execution flow. This can lead to various consequences, including remote code execution, unauthorized access to sensitive information, and potential compromise of the Moodle instance. The vulnerability has been assigned the identifier CVE-2014-3541 and has a severity rating of HIGH.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.4.112.4.11composer require moodle/moodle:2.4.11 -
>= 2.5.0, < 2.5.72.5.7composer require moodle/moodle:2.5.7 -
>= 2.6.0, < 2.6.42.6.4composer require moodle/moodle:2.6.4 -
>= 2.7.0, < 2.7.12.7.1composer require moodle/moodle:2.7.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a workaround, if immediate patching is not feasible, administrators can disable the affected Repositories module until the Moodle instance can be updated. This can be done by navigating to the Moodle administration panel, selecting 'Site administration,' 'Plugins,' 'Repositories,' and disabling the module. However, this workaround should only be considered temporary, and updating to the latest secure version is strongly recommended.
Conclusion
The vulnerability in Moodle exposes the system to PHP object injection attacks, which can result in the execution of arbitrary code and potential compromise of the Moodle instance. It is crucial for administrators to update their Moodle installations to the latest secure versions to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for moodle/moodle →
FAQ
Moodle is an open-source learning management system (LMS) used by educational institutions to create online courses and manage learning content.
PHP object injection is a vulnerability that allows an attacker to manipulate serialized data to inject malicious PHP objects into an application's code execution flow.
The vulnerability in Moodle can lead to remote code execution, unauthorized access to sensitive information, and compromise of the Moodle instance.
To fix the vulnerability, update Moodle to version 2.4.11, 2.5.7, 2.6.4, or 2.7.1, depending on the installed version. Follow the official Moodle documentation for upgrading your installation.
Yes, administrators can temporarily disable the affected Repositories module until the Moodle instance can be updated. This can be done through the Moodle administration panel.
References
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
