CVE-2014-7833: Moodle allows attackers to obtain sensitive information
Summary
CVE-2014-7833: Moodle allows attackers to obtain sensitive information. Affects moodle/moodle across 3 version ranges.
< 2.5.9
>= 2.6.0, < 2.6.6
>= 2.7.0, < 2.7.3
Fixed in 2.5.9, 2.6.6 or 2.7.3, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning management system (LMS) used for creating and delivering online courses. It provides a platform for educators to create interactive learning environments and engage with students. Moodle is widely adopted in educational institutions and organizations worldwide. However, versions of Moodle prior to 2.5.9, 2.6.6, and 2.7.3 are vulnerable to an information disclosure vulnerability.
Vulnerability Detail
The vulnerability exists in the 'mod/data/edit.php' file of Moodle. When a teacher makes changes to a database entry, the group ID is set to zero. This behavior allows remote authenticated users to access the database and obtain sensitive information after a teacher's edit. An attacker with valid credentials can exploit this vulnerability to gain unauthorized access to sensitive data stored in the Moodle database.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.5.92.5.9composer require moodle/moodle:2.5.9 -
>= 2.6.0, < 2.6.62.6.6composer require moodle/moodle:2.6.6 -
>= 2.7.0, < 2.7.32.7.3composer require moodle/moodle:2.7.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by upgrading to the patched versions of Moodle.
Conclusion
The information disclosure vulnerability in Moodle versions prior to 2.5.9, 2.6.6, and 2.7.3 can allow remote authenticated users to obtain sensitive information from the database. It is recommended to upgrade to the latest secure version of Moodle to mitigate the risk of unauthorized data access. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for moodle/moodle →
FAQ
Moodle is an open-source learning management system used for creating and delivering online courses.
Versions of Moodle prior to 2.5.9, 2.6.6, and 2.7.3 are vulnerable to this information disclosure vulnerability.
The vulnerability allows remote authenticated users to access sensitive information stored in the Moodle database.
To fix this vulnerability, upgrade your Moodle installation to version 2.5.9, 2.6.6, or 2.7.3, depending on the installed version.
No, there is no known workaround. It is crucial to apply the recommended fix by upgrading to the patched versions of Moodle.
References
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
