CVE-2014-9060: Arbitrary Message Generation in Moodle
Summary
CVE-2014-9060: Moodle allows attackers to trigger the generation of arbitrary messages. Affects moodle/moodle across 3 version ranges.
< 2.5.9
>= 2.6.0, < 2.6.6
>= 2.7.0, < 2.7.3
Fixed in 2.5.9, 2.6.6 or 2.7.3, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning management system (LMS) used for creating and delivering online courses. It provides a platform for educators to create interactive and collaborative learning environments. Moodle is widely adopted in educational institutions and organizations around the world.
Vulnerability Detail
The LTI module in Moodle versions prior to 2.5.9, 2.6.6, and 2.7.3 does not properly restrict the parameters used in a return URL. This allows remote attackers to trigger the generation of arbitrary messages by modifying the URL. The vulnerability is located in the mod/lti/locallib.php and mod/lti/return.php files. An attacker can exploit this vulnerability to manipulate the messages generated by the LTI module, potentially leading to unauthorized access or information disclosure.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.5.92.5.9composer require moodle/moodle:2.5.9 -
>= 2.6.0, < 2.6.62.6.6composer require moodle/moodle:2.6.6 -
>= 2.7.0, < 2.7.32.7.3composer require moodle/moodle:2.7.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update Moodle to the fixed versions mentioned above.
Conclusion
The vulnerability in Moodle's LTI module allows attackers to trigger the generation of arbitrary messages by manipulating the return URL. To mitigate this risk, it is essential to update Moodle to the fixed versions (2.5.9, 2.6.6, or 2.7.3) that properly restrict the parameters. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for moodle/moodle →
FAQ
Moodle is an open-source learning management system (LMS) used for creating and delivering online courses. It provides a platform for educators to create interactive and collaborative learning environments.
The LTI (Learning Tools Interoperability) module in Moodle allows integration with external learning tools and systems. It enables instructors to incorporate external resources and activities into their Moodle courses.
The vulnerability in the LTI module allows remote attackers to manipulate the messages generated by the module. This can potentially lead to unauthorized access or information disclosure in Moodle installations.
To fix the vulnerability, it is recommended to update Moodle to version 2.5.9, 2.6.6, or 2.7.3, depending on the installed version. These versions include the necessary patches to restrict the parameters used in the return URL and prevent the generation of arbitrary messages.
There is no known workaround for this vulnerability. It is crucial to update Moodle to the fixed versions mentioned above to mitigate the risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
