CVE-2015-0215: Moodle allows attackers to obtain sensitive calendar-event information
Summary
CVE-2015-0215: Moodle allows attackers to obtain sensitive calendar-event information. Affects moodle/moodle across 3 version ranges.
< 2.6.7
>= 2.7.0, < 2.7.4
>= 2.8.0, < 2.8.2
Fixed in 2.6.7, 2.7.4 or 2.8.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning management system (LMS) used by educational institutions worldwide. It provides a platform for creating and managing online courses, including features like calendars for scheduling events. Moodle versions prior to 2.6.7, 2.7.4, and 2.8.2 are vulnerable to an information disclosure issue in the calendar module.
Vulnerability Detail
The vulnerability exists in the 'calendar/externallib.php' file of Moodle. It allows remote authenticated users to obtain sensitive calendar-event information by exploiting a web-services request. This could lead to unauthorized access to confidential data, compromising the privacy and security of users' calendar events.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.6.72.6.7composer require moodle/moodle:2.6.7 -
>= 2.7.0, < 2.7.42.7.4composer require moodle/moodle:2.7.4 -
>= 2.8.0, < 2.8.22.8.2composer require moodle/moodle:2.8.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading immediately is not feasible, a temporary workaround can be implemented by restricting access to the affected 'calendar/externallib.php' file or disabling the web-services feature in Moodle. However, these workarounds may limit the functionality of the LMS and should only be considered as temporary measures until the upgrade can be performed.
Conclusion
The vulnerability in Moodle versions prior to 2.6.7, 2.7.4, and 2.8.2 allows remote authenticated users to obtain sensitive calendar-event information. It is crucial to upgrade to the latest stable release or apply the necessary security patches to mitigate the risk of unauthorized access to confidential data. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for moodle/moodle →
FAQ
Moodle is an open-source learning management system used for creating and managing online courses.
Moodle versions prior to 2.6.7, 2.7.4, and 2.8.2 are affected.
An attacker with remote authenticated access can exploit this vulnerability by sending a specially crafted web-services request to the affected 'calendar/externallib.php' file.
The vulnerability allows attackers to obtain sensitive calendar-event information, potentially compromising the privacy and security of users' data.
Yes, upgrading to Moodle versions 2.6.7, 2.7.4, or 2.8.2 will fix this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
