CVE-2015-0213: Moodle Glossary Module Multiple CSRF Vulnerabilities
Summary
CVE-2015-0213: Moodle multiple cross-site request forgery (CSRF) vulnerabilities. Affects moodle/moodle across 3 version ranges.
< 2.6.7
>= 2.7.0, < 2.7.4
>= 2.8.0, < 2.8.2
Fixed in 2.6.7, 2.7.4 or 2.8.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning management system (LMS) used for creating and delivering online courses. It provides a wide range of features for educators and learners, including course management, content creation, and collaboration tools. The Glossary module in Moodle allows users to create and manage a collection of definitions and terms. This module is vulnerable to multiple cross-site request forgery (CSRF) vulnerabilities.
Vulnerability Detail
The Glossary module in Moodle versions up to 2.5.9, 2.6.x before 2.6.7, 2.7.x before 2.7.4, and 2.8.x before 2.8.2 is affected by multiple CSRF vulnerabilities. These vulnerabilities allow remote attackers to hijack the authentication of unspecified victims. By exploiting these vulnerabilities, an attacker can perform unauthorized actions on behalf of the victim, potentially leading to data manipulation, privilege escalation, or other malicious activities.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.6.72.6.7composer require moodle/moodle:2.6.7 -
>= 2.7.0, < 2.7.42.7.4composer require moodle/moodle:2.7.4 -
>= 2.8.0, < 2.8.22.8.2composer require moodle/moodle:2.8.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround provided for these CSRF vulnerabilities. It is crucial to apply the available updates to mitigate the risk of exploitation.
Conclusion
The Glossary module in Moodle is vulnerable to multiple CSRF vulnerabilities that can be exploited by remote attackers to hijack user authentication. To mitigate these vulnerabilities, it is crucial to update Moodle to the latest version and apply the available security patches. Regularly updating Moodle and its modules is essential to ensure the security of the learning management system.
See every vulnerability recorded for moodle/moodle →
FAQ
Moodle is an open-source learning management system (LMS) used for creating and delivering online courses. It provides a wide range of features for educators and learners.
The Glossary module in Moodle allows users to create and manage a collection of definitions and terms.
Cross-Site Request Forgery (CSRF) vulnerabilities allow attackers to perform unauthorized actions on behalf of authenticated users.
By exploiting these vulnerabilities, an attacker can manipulate data, escalate privileges, or perform other malicious activities on behalf of the victim.
To protect your Moodle installation, it is important to regularly update to the latest version and apply security patches. Additionally, implementing strong authentication mechanisms and using secure coding practices can help mitigate the risk of CSRF vulnerabilities.
References
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
