CVE-2015-2268: Denial of Service Vulnerability in Moodle
Summary
CVE-2015-2268: Moodle allows attackers to cause a denial of service. Affects moodle/moodle across 3 version ranges.
< 2.6.9
>= 2.7.0, < 2.7.6
>= 2.8.0, < 2.8.4
Fixed in 2.6.9, 2.7.6 or 2.8.4, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Moodle is an open-source learning management system (LMS) used by educational institutions to create and deliver online courses. It provides a platform for educators to create interactive learning environments and engage with students. Moodle is written in PHP and utilizes a modular architecture to support various features such as forums, quizzes, assignments, and more. However, Moodle versions prior to 2.8.4 are vulnerable to a denial of service (DoS) attack.
Vulnerability Detail
The vulnerability, identified as CVE-2015-2268, exists in the 'filter/urltolink/filter.php' file of Moodle. It affects versions 2.5.9, 2.6.x (before 2.6.9), 2.7.x (before 2.7.6), and 2.8.x (before 2.8.4). Remote authenticated users can exploit this vulnerability by providing a crafted string that matches an improper regular expression. This can lead to CPU consumption or partial outage, causing a DoS condition. The improper handling of the string allows an attacker to manipulate the regular expression and trigger the DoS attack.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.6.92.6.9composer require moodle/moodle:2.6.9 -
>= 2.7.0, < 2.7.62.7.6composer require moodle/moodle:2.7.6 -
>= 2.8.0, < 2.8.42.8.4composer require moodle/moodle:2.8.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a workaround, administrators can disable the 'filter/urltolink' filter in Moodle until the upgrade can be performed. This can be done by accessing the Moodle administration panel, navigating to the 'Site administration' section, selecting 'Plugins', and then 'Filters'. From there, the 'filter/urltolink' filter can be disabled. However, this workaround should only be considered temporary, and upgrading to a patched version is strongly recommended.
Conclusion
The vulnerability in Moodle versions prior to 2.8.4 allows authenticated users to cause a denial of service by exploiting an improper regular expression in the 'filter/urltolink/filter.php' file. To mitigate this vulnerability, it is crucial to upgrade Moodle to the recommended patched versions. Administrators can also temporarily disable the vulnerable filter as a workaround. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for moodle/moodle →
FAQ
Moodle is an open-source learning management system used by educational institutions to create and deliver online courses.
The vulnerability allows authenticated users to cause a denial of service by consuming excessive CPU resources or causing a partial outage.
To fix this vulnerability, upgrade Moodle to version 2.6.9, 2.7.6, or 2.8.4, depending on the installed version.
Yes, administrators can disable the 'filter/urltolink' filter in Moodle as a temporary workaround until the upgrade can be performed.
More information about upgrading Moodle can be found in the official Moodle documentation.
References
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
