CVE-2014-7831: Moodle exposes hidden grades to students
Summary
CVE-2014-7831: Moodle exposes hidden grades to students. Affects moodle/moodle versions >= 2.7.0, < 2.7.3. Fixed in 2.7.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning management system (LMS) used by educational institutions worldwide. It provides a platform for creating and managing online courses, allowing teachers to deliver content, interact with students, and assess their progress. Moodle offers various features, including a grading system that allows instructors to assign and track grades for students. However, a vulnerability in Moodle versions 2.7.x before 2.7.3 exposes hidden grades to students, compromising the confidentiality of sensitive information.
Vulnerability Detail
The vulnerability resides in the 'grades_external.php' file in Moodle. The system fails to consider the 'moodle/grade:viewhidden' capability before displaying hidden grades. As a result, remote authenticated users with the student role can exploit this flaw to access the 'get_grades' web service and obtain sensitive information. This vulnerability has a moderate severity rating and is assigned the CVE identifier CVE-2014-7831. It was published on May 13, 2022, and its details can be found in the GitHub Security Advisory GHSA-59j6-8g7w-prf7.
How To Fix
Minimum fixed version
2.7.3
This is the first release that contains the fix.
composer require moodle/moodle:2.7.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, users can mitigate the risk by ensuring that only authorized users have the student role and restricting access to the 'get_grades' web service. Additionally, implementing proper access controls and regularly reviewing user roles and permissions can help prevent unauthorized access to sensitive information.
Conclusion
In conclusion, Moodle versions 2.7.x before 2.7.3 are vulnerable to exposing hidden grades to students. This can be exploited by remote authenticated users with the student role, compromising the confidentiality of sensitive information. To mitigate this risk, it is recommended to upgrade Moodle to version 2.7.3 or later. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for moodle/moodle →
FAQ
Moodle is an open-source learning management system (LMS) used by educational institutions to create and manage online courses.
This vulnerability allows remote authenticated users with the student role to access hidden grades, compromising the confidentiality of sensitive information.
To fix this vulnerability, upgrade Moodle to version 2.7.3 or later, which includes the necessary fix to properly consider the 'moodle/grade:viewhidden' capability.
While no specific workaround is mentioned, users can mitigate the risk by ensuring proper access controls and restricting access to the 'get_grades' web service.
This vulnerability has a moderate severity rating, indicating a potential impact on the confidentiality of sensitive information.
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.