CVE-2014-3553: Moodle - Inadequate access restriction enforcement
Summary
CVE-2014-3553: Moodle does not enforce the moodle/site:accessallgroups capability requirement. Affects moodle/moodle across 3 version ranges.
< 2.5.7
>= 2.6.0, < 2.6.4
>= 2.7.0, < 2.7.1
Fixed in 2.5.7, 2.6.4 or 2.7.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning management system (LMS) used for creating and delivering online courses. It provides a platform for educators to create interactive and collaborative learning environments. Moodle offers various features such as discussion forums, assignments, quizzes, and grading tools. However, a vulnerability has been identified in Moodle versions 2.3.11 to 2.7.1 that allows remote authenticated users to bypass access restrictions by leveraging multiple group memberships.
Vulnerability Detail
The vulnerability exists in the 'mod/forum/classes/post_form.php' file of Moodle. This file does not properly enforce the 'moodle/site:accessallgroups' capability requirement before allowing a post to all groups. As a result, a remote authenticated user with two or more group memberships can bypass the intended access restrictions and post to all groups. This vulnerability can be exploited to gain unauthorized access to sensitive information or perform malicious actions within the Moodle system.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.5.72.5.7composer require moodle/moodle:2.5.7 -
>= 2.6.0, < 2.6.42.6.4composer require moodle/moodle:2.6.4 -
>= 2.7.0, < 2.7.12.7.1composer require moodle/moodle:2.7.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by updating Moodle to the appropriate version.
Conclusion
The identified vulnerability in Moodle versions 2.3.11 to 2.7.1 allows remote authenticated users to bypass access restrictions and post to all groups. It is crucial to update Moodle to the recommended versions to mitigate the risk of unauthorized access and potential malicious actions. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for moodle/moodle →
FAQ
Moodle is an open-source learning management system (LMS) used for creating and delivering online courses. It provides a platform for educators to create interactive and collaborative learning environments.
This vulnerability allows remote authenticated users to bypass access restrictions and post to all groups in Moodle. It can lead to unauthorized access to sensitive information or malicious actions within the Moodle system.
To fix this vulnerability, update Moodle to version 2.5.7, 2.6.4, or 2.7.1, depending on the installed version. These versions include the necessary fixes to enforce the access restriction properly.
No, there is no known workaround for this vulnerability. It is crucial to apply the recommended fix by updating Moodle to the appropriate version.
You can use Vulert's playground at Vulert Scanner to check if your Moodle installation is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation.
References
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
