CVE-2014-7832: Moodle mod/lti:view Capability Bypass
Summary
CVE-2014-7832: Moodle allows attackers to bypass the mod/lti:view capability requirement. Affects moodle/moodle across 3 version ranges.
< 2.5.9
>= 2.6.0, < 2.6.6
>= 2.7.0, < 2.7.3
Fixed in 2.5.9, 2.6.6 or 2.7.3, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning management system (LMS) used by educational institutions to create and deliver online courses. It provides a platform for educators to manage course content, interact with students, and facilitate learning activities. The LTI module in Moodle allows instructors to integrate external tools and resources into their courses using the Learning Tools Interoperability (LTI) standard.
Vulnerability Detail
The mod/lti:view capability in Moodle is intended to control access to LTI activities at the activity level. However, prior to versions 2.5.9, 2.6.6, and 2.7.3, the access control was implemented at the course level instead. This flaw enables remote authenticated users to bypass the mod/lti:view capability requirement by viewing an activity instance. By exploiting this vulnerability, an attacker could gain unauthorized access to LTI activities and potentially manipulate or extract sensitive information.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.5.92.5.9composer require moodle/moodle:2.5.9 -
>= 2.6.0, < 2.6.62.6.6composer require moodle/moodle:2.6.6 -
>= 2.7.0, < 2.7.32.7.3composer require moodle/moodle:2.7.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update Moodle to the fixed versions mentioned above.
Conclusion
The vulnerability in Moodle's LTI module allows authenticated users to bypass the mod/lti:view capability requirement and gain unauthorized access to LTI activities. It is crucial to update Moodle to the fixed versions to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for moodle/moodle →
FAQ
Moodle is an open-source learning management system used by educational institutions for online course management.
The LTI module in Moodle allows instructors to integrate external tools and resources into their courses using the Learning Tools Interoperability standard.
The mod/lti:view capability is a permission in Moodle that controls access to LTI activities.
By bypassing the mod/lti:view capability requirement, an attacker can gain unauthorized access to LTI activities and potentially manipulate or extract sensitive information.
Update Moodle to version 2.5.9, 2.6.6, or 2.7.3, depending on the installed version, to address the access control issue.
References
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
