CVE-2015-2270: Moodle allows attackers to obtain sensitive course information
Summary
CVE-2015-2270: Moodle allows attackers to obtain sensitive course information. Affects moodle/moodle across 3 version ranges.
< 2.6.9
>= 2.7.0, < 2.7.6
>= 2.8.0, < 2.8.4
Fixed in 2.6.9, 2.7.6 or 2.8.4, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning management system (LMS) used by educational institutions to create and manage online courses. It provides a platform for educators to deliver content, interact with students, and assess their progress. Moodle is widely adopted and offers a range of features and plugins to enhance the learning experience. However, a vulnerability has been identified in Moodle versions 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4 that allows attackers to obtain sensitive course information.
Vulnerability Detail
The vulnerability exists in the 'lib/moodlelib.php' file when the theme uses the 'blocks-regions' feature. During the login-validation process, the course state is established at an incorrect point, leading to the exposure of sensitive course information. This vulnerability can be exploited by remote attackers through unspecified vectors. The exact method of exploitation is not disclosed in the vulnerability details.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.6.92.6.9composer require moodle/moodle:2.6.9 -
>= 2.7.0, < 2.7.62.7.6composer require moodle/moodle:2.7.6 -
>= 2.8.0, < 2.8.42.8.4composer require moodle/moodle:2.8.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
No specific workaround is provided in the vulnerability details. It is advised to apply the recommended updates as soon as possible to mitigate the risk of sensitive course information exposure.
Conclusion
The vulnerability in Moodle versions 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4 allows remote attackers to obtain sensitive course information. It is crucial to update Moodle to the recommended versions to address this vulnerability and protect the confidentiality of course data. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for moodle/moodle →
FAQ
Moodle is an open-source learning management system (LMS) used by educational institutions to create and manage online courses.
Moodle versions 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4 are affected.
The exact method of exploitation is not disclosed in the vulnerability details. Remote attackers can exploit the vulnerability through unspecified vectors.
Yes, updating Moodle to the recommended versions (2.6.9, 2.7.6, or 2.8.4) will address the vulnerability and mitigate the risk.
No specific workaround is provided in the vulnerability details. Applying the recommended updates is the best course of action.
References
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
