CVE-2014-7846: Moodle - Inadequate Tag Access Control
Summary
CVE-2014-7846: Moodle does not consider the moodle/tag:edit capability before adding a tag. Affects moodle/moodle across 3 version ranges.
< 2.5.9
>= 2.6.0, < 2.6.6
>= 2.7.0, < 2.7.3
Fixed in 2.5.9, 2.6.6 or 2.7.3, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Moodle is an open-source learning management system (LMS) used for creating and delivering online courses. It provides a wide range of features for educators and learners, including content management, assessments, and collaboration tools. Moodle allows users to tag various resources, such as courses, forum posts, and files, to facilitate organization and searchability. However, prior to version 2.7.3, Moodle did not properly enforce access restrictions when adding tags, potentially allowing authenticated users to bypass intended limitations.
Vulnerability Detail
The vulnerability (CVE-2014-7846) in Moodle arises from the inadequate consideration of the 'moodle/tag:edit' capability before adding a tag. The 'tag/tag_autocomplete.php' script, present in Moodle versions 2.4.11 to 2.7.2, fails to verify the user's permissions before processing an AJAX request to add a tag. As a result, authenticated users with lower privileges can exploit this flaw to add tags to resources they should not have access to, effectively bypassing the intended restrictions. This vulnerability poses a moderate risk as it can lead to unauthorized access and potential information disclosure.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.5.92.5.9composer require moodle/moodle:2.5.9 -
>= 2.6.0, < 2.6.62.6.6composer require moodle/moodle:2.6.6 -
>= 2.7.0, < 2.7.32.7.3composer require moodle/moodle:2.7.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
No specific workaround has been provided for this vulnerability. It is advised to apply the recommended fix by upgrading to a patched version of Moodle.
Conclusion
The vulnerability in Moodle versions 2.4.11 to 2.7.2 allows authenticated users to bypass access restrictions and add tags to resources they should not have access to. To mitigate this risk, it is crucial to upgrade to Moodle versions 2.5.9, 2.6.6, or 2.7.3, or later. Keeping the LMS up to date is essential for maintaining the security and integrity of user data. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for moodle/moodle →
FAQ
Moodle is an open-source learning management system (LMS) used for creating and delivering online courses. It provides a wide range of features for educators and learners, including content management, assessments, and collaboration tools.
The vulnerability allows authenticated users to bypass access restrictions and add tags to resources they should not have access to. This can lead to unauthorized access and potential information disclosure.
Moodle versions 2.4.11 to 2.7.2 are affected by this vulnerability.
To fix this vulnerability, it is recommended to upgrade to Moodle versions 2.5.9, 2.6.6, or 2.7.3, or later.
No specific workaround has been provided for this vulnerability. It is advised to apply the recommended fix by upgrading to a patched version of Moodle.
References
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
