CVE-2014-7848: Moodle allows attacks to obtain sensitive information
Summary
CVE-2014-7848: Moodle allows attacks to obtain sensitive information. Affects moodle/moodle across 2 version ranges.
>= 2.6.0, < 2.6.6
>= 2.7.0, < 2.7.3
Fixed in 2.6.6 or 2.7.3, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning management system (LMS) used by educational institutions worldwide. It provides a platform for creating and managing online courses, allowing educators to deliver content, interact with students, and assess their progress. Moodle is written in PHP and relies on various libraries and frameworks for its functionality.
Vulnerability Detail
The vulnerability identified as CVE-2014-7848 affects Moodle versions 2.6.x before 2.6.6 and 2.7.x before 2.7.3. It allows remote attackers to obtain sensitive information by exploiting a flaw in the lib/phpunit/bootstrap.php file. By making a direct request, an attacker can trigger an error message that reveals the full path of the Moodle installation. This information can be leveraged to gain further knowledge about the system and potentially facilitate other attacks.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 2.6.0, < 2.6.62.6.6composer require moodle/moodle:2.6.6 -
>= 2.7.0, < 2.7.32.7.3composer require moodle/moodle:2.7.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. It is crucial to apply the recommended fix by upgrading to the patched versions of Moodle.
Conclusion
The vulnerability in Moodle versions 2.6.x and 2.7.x allows attackers to obtain sensitive information by exploiting a flaw in the lib/phpunit/bootstrap.php file. Upgrading to the recommended patched versions, 2.6.6 or 2.7.3, is crucial to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for moodle/moodle →
FAQ
Moodle is an open-source learning management system used for online education.
Moodle versions 2.6.x before 2.6.6 and 2.7.x before 2.7.3 are affected.
By making a direct request, an attacker can trigger an error message that reveals the full path of the Moodle installation.
The disclosure of sensitive information can provide attackers with valuable insights into the Moodle system, potentially aiding in further attacks.
Upgrade Moodle to version 2.6.6 or 2.7.3, depending on the currently installed version.
References
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
