CVE-2015-0214: Moodle allows attackers to bypass a messaging-disabled setting
Summary
CVE-2015-0214: Moodle allows attackers to bypass a messaging-disabled setting. Affects moodle/moodle across 3 version ranges.
< 2.6.7
>= 2.7.0, < 2.7.4
>= 2.8.0, < 2.8.2
Fixed in 2.6.7, 2.7.4 or 2.8.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning management system (LMS) used by educational institutions to create and deliver online courses. It provides a platform for educators to manage and organize course materials, interact with students, and facilitate communication. Moodle is widely adopted and offers various features such as messaging capabilities to enable communication between users.
Vulnerability Detail
The vulnerability identified as CVE-2015-0214 affects Moodle versions through 2.5.9, 2.6.x before 2.6.7, 2.7.x before 2.7.4, and 2.8.x before 2.8.2. It allows remote authenticated users to bypass a messaging-disabled setting by exploiting a flaw in the 'message/externallib.php' file. Attackers can achieve this by sending a web-services request, specifically a people-search request, thereby circumventing the intended restriction on messaging functionality. This vulnerability poses a moderate risk as it enables unauthorized access to messaging features, potentially compromising user privacy and security.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.6.72.6.7composer require moodle/moodle:2.6.7 -
>= 2.7.0, < 2.7.42.7.4composer require moodle/moodle:2.7.4 -
>= 2.8.0, < 2.8.22.8.2composer require moodle/moodle:2.8.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. Users are advised to apply the recommended fix by upgrading to the patched versions of Moodle.
Conclusion
The identified vulnerability in Moodle allows attackers to bypass a messaging-disabled setting, potentially compromising user privacy and security. Users are advised to upgrade their Moodle installations to the patched versions (2.6.7, 2.7.4, or 2.8.2) to mitigate the risk of exploitation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for moodle/moodle →
FAQ
Moodle is an open-source learning management system (LMS) used by educational institutions to create and deliver online courses.
This vulnerability allows remote authenticated users to bypass a messaging-disabled setting, potentially compromising user privacy and security.
Moodle versions through 2.5.9, 2.6.x before 2.6.7, 2.7.x before 2.7.4, and 2.8.x before 2.8.2 are affected.
To fix this vulnerability, it is recommended to upgrade to a patched version of Moodle (2.6.7, 2.7.4, or 2.8.2).
No specific workaround is provided. Upgrading to the patched versions is the recommended solution.
References
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
