CVE-2014-7837: Moodle allows attackers to remove wiki pages
Summary
CVE-2014-7837: Moodle allows attackers to remove wiki pages. Affects moodle/moodle across 3 version ranges.
< 2.5.9
>= 2.6.0, < 2.6.6
>= 2.7.0, < 2.7.3
Fixed in 2.5.9, 2.6.6 or 2.7.3, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning management system (LMS) used by educational institutions to create and manage online courses. It provides various features, including collaborative tools like wikis. Moodle versions 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 are affected by a vulnerability that allows remote authenticated users to remove wiki pages if they have delete access within a different subwiki.
Vulnerability Detail
The vulnerability in Moodle allows authenticated users to delete wiki pages by exploiting their delete access in a different subwiki. This means that an attacker with the necessary permissions in one subwiki can remove pages in another subwiki. This can lead to unauthorized removal of important content and disrupt the collaborative learning environment. The vulnerability has a moderate severity rating.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.5.92.5.9composer require moodle/moodle:2.5.9 -
>= 2.6.0, < 2.6.62.6.6composer require moodle/moodle:2.6.6 -
>= 2.7.0, < 2.7.32.7.3composer require moodle/moodle:2.7.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended solution is to upgrade to the fixed versions of Moodle.
Conclusion
The vulnerability in Moodle allows authenticated users to remove wiki pages by leveraging delete access within a different subwiki. To mitigate this vulnerability, it is crucial to upgrade to the fixed versions of Moodle. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for moodle/moodle →
FAQ
Moodle is an open-source learning management system used for creating and managing online courses.
The vulnerability allows authenticated users to delete wiki pages, potentially leading to the unauthorized removal of important content.
Moodle versions 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 are affected.
To fix this vulnerability, upgrade to the fixed versions of Moodle: 2.5.9 or later for 2.5.x, 2.6.6 or later for 2.6.x, and 2.7.3 or later for 2.7.x.
No specific workaround is mentioned. Upgrading to the fixed versions is the recommended solution.
References
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
