CVE-2015-0218: Moodle cross-site request forgery (CSRF) vulnerability
Summary
CVE-2015-0218: Moodle cross-site request forgery (CSRF) vulnerability. Affects moodle/moodle across 3 version ranges.
< 2.6.7
>= 2.7.0, < 2.7.4
>= 2.8.0, < 2.8.2
Fixed in 2.6.7, 2.7.4 or 2.8.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning management system (LMS) used by educational institutions to create and deliver online courses. It provides a platform for educators to manage course materials, interact with students, and track their progress. The vulnerability described here affects Moodle versions 2.5.9, 2.6.x before 2.6.7, 2.7.x before 2.7.4, and 2.8.x before 2.8.2.
Vulnerability Detail
The vulnerability is a cross-site request forgery (CSRF) issue that exists in the 'auth/shibboleth/logout.php' file of Moodle. It allows remote attackers to hijack the authentication of arbitrary users by triggering a logout request. This means that an attacker can force a user to log out of their Moodle session, potentially leading to unauthorized access or other malicious activities.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.6.72.6.7composer require moodle/moodle:2.6.7 -
>= 2.7.0, < 2.7.42.7.4composer require moodle/moodle:2.7.4 -
>= 2.8.0, < 2.8.22.8.2composer require moodle/moodle:2.8.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to the latest version is not immediately possible, a temporary workaround is to disable the 'auth/shibboleth/logout.php' file or implement additional CSRF protection measures. However, these workarounds may not provide complete protection and should only be considered as temporary solutions until the upgrade can be performed.
Conclusion
The CSRF vulnerability in Moodle can be mitigated by upgrading to the latest version of the software. It is important to promptly apply the necessary patches to ensure the security of the Moodle installation. For further support and assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for moodle/moodle →
FAQ
Moodle is an open-source learning management system (LMS) used by educational institutions to create and deliver online courses.
A CSRF vulnerability allows an attacker to trick a user into performing unwanted actions on a web application in which the user is authenticated.
The CSRF vulnerability in Moodle allows an attacker to hijack the authentication of arbitrary users, potentially leading to unauthorized access or other malicious activities.
To fix the vulnerability, it is recommended to upgrade to the latest version of Moodle (2.6.7, 2.7.4, or 2.8.2).
If upgrading immediately is not possible, you can consider disabling the 'auth/shibboleth/logout.php' file or implementing additional CSRF protection measures as temporary solutions.
References
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
