CVE-2015-0211: Moodle allows attackers to obtain sensitive information
Summary
CVE-2015-0211: Moodle allows attackers to obtain sensitive information. Affects moodle/moodle across 3 version ranges.
< 2.6.7
>= 2.7.0, < 2.7.4
>= 2.8.0, < 2.8.2
Fixed in 2.6.7, 2.7.4 or 2.8.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning management system (LMS) used by educational institutions worldwide. It provides a platform for creating and managing online courses, allowing educators to deliver content, interact with students, and track their progress. Moodle is written in PHP and offers a wide range of features and plugins to enhance the learning experience. However, a vulnerability has been discovered in Moodle versions 2.5.9 through 2.8.2 that allows remote authenticated users to obtain sensitive information.
Vulnerability Detail
The vulnerability exists in the mod/lti/ajax.php file in Moodle. The system does not properly consider the moodle/course:manageactivities and mod/lti:addinstance capabilities before performing registered-tool list searches. This oversight allows remote authenticated users to exploit the LTI Ajax service and retrieve sensitive information. By sending requests to the LTI Ajax service, attackers can obtain data that they should not have access to, potentially compromising the confidentiality of user information and course content.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.6.72.6.7composer require moodle/moodle:2.6.7 -
>= 2.7.0, < 2.7.42.7.4composer require moodle/moodle:2.7.4 -
>= 2.8.0, < 2.8.22.8.2composer require moodle/moodle:2.8.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the official patches or upgrade to the latest version of Moodle to mitigate the risk.
Conclusion
The vulnerability in Moodle versions 2.5.9 through 2.8.2 allows remote authenticated users to obtain sensitive information. To mitigate the risk, it is crucial to upgrade to the latest version of Moodle or apply the official patches. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for moodle/moodle →
FAQ
Moodle is an open-source learning management system used by educational institutions to create and manage online courses.
Moodle versions 2.5.9 through 2.8.2 are affected by this vulnerability.
An attacker with remote authenticated access to Moodle can send requests to the LTI Ajax service and retrieve sensitive information.
The vulnerability allows unauthorized access to sensitive information, potentially compromising user data and course content.
To protect your Moodle installation, upgrade to the latest version or apply the official patches provided by Moodle.
References
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
