CVE-2014-3617: Moodle allows discovery of an author's username
Summary
CVE-2014-3617: Moodle allows discovery of an author's username. Affects moodle/moodle across 3 version ranges.
< 2.5.8
>= 2.6.0, < 2.6.5
>= 2.7.0, < 2.7.2
Fixed in 2.5.8, 2.6.5 or 2.7.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Moodle is an open-source learning management system (LMS) used by educational institutions worldwide. It provides a platform for creating and managing online courses, forums, and other collaborative learning activities. The mod/forum/lib.php file in Moodle versions 2.4.11, 2.5.x before 2.5.8, 2.6.x before 2.6.5, and 2.7.x before 2.7.2 contains a vulnerability that allows authenticated users to bypass the individual answer-posting requirement in Q&A forums and discover the username of an author. This vulnerability can be exploited by leveraging the student role and visiting a Q&A forum.
Vulnerability Detail
The vulnerability in Moodle allows authenticated users to bypass the individual answer-posting requirement in Q&A forums and discover the username of an author. By leveraging the student role and visiting a Q&A forum, an attacker can bypass the mod/forum:viewqandawithoutposting capability and view the author's username. This information can be used for malicious purposes, such as impersonation or targeted attacks against the author.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.5.82.5.8composer require moodle/moodle:2.5.8 -
>= 2.6.0, < 2.6.52.6.5composer require moodle/moodle:2.6.5 -
>= 2.7.0, < 2.7.22.7.2composer require moodle/moodle:2.7.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Conclusion
The vulnerability in Moodle allows authenticated users to bypass the individual answer-posting requirement in Q&A forums and discover the username of an author. Upgrading to the latest version of Moodle (2.5.8, 2.6.5, or 2.7.2) will fix this vulnerability and prevent any potential exploitation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for moodle/moodle →
FAQ
Moodle is an open-source learning management system used by educational institutions for online course management and collaboration.
This vulnerability allows authenticated users to discover the username of an author in Q&A forums, which can be used for impersonation or targeted attacks.
To fix this vulnerability, upgrade to the latest version of Moodle (2.5.8, 2.6.5, or 2.7.2).
No specific workarounds have been provided for this vulnerability.
You can find more information about this vulnerability in the GitHub advisory database.
References
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
