Moodle Account Confirmation Full-Name Information Disclosure
Summary
CVE-2015-3176: Moodle allows attackers obtain full-name information. Affects moodle/moodle across 3 version ranges.
< 2.6.11
>= 2.7.0, < 2.7.8
>= 2.8.0, < 2.8.6
Fixed in 2.6.11, 2.7.8 or 2.8.6, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning management system (LMS) used by educational institutions to create and deliver online courses. It provides a platform for teachers and students to interact, share resources, and participate in various educational activities. Moodle is widely adopted and has a large user base. However, it is susceptible to security vulnerabilities that can compromise the confidentiality and integrity of user data.
Vulnerability Detail
The account-confirmation feature in Moodle versions prior to 2.6.11, 2.7.8, and 2.8.6 allows remote attackers to obtain sensitive full-name information by attempting to self-register. This vulnerability arises from a flaw in the login/confirm.php file. Attackers can exploit this vulnerability by sending specially crafted requests to the affected Moodle instance, tricking it into disclosing full-name information that should remain confidential. This information disclosure can lead to privacy breaches and potentially enable further attacks, such as identity theft or social engineering.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.6.112.6.11composer require moodle/moodle:2.6.11 -
>= 2.7.0, < 2.7.82.7.8composer require moodle/moodle:2.7.8 -
>= 2.8.0, < 2.8.62.8.6composer require moodle/moodle:2.8.6
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. It is essential to apply the recommended fix by upgrading to the patched versions of Moodle.
Conclusion
The account-confirmation feature in Moodle versions prior to 2.6.11, 2.7.8, and 2.8.6 is vulnerable to information disclosure, allowing attackers to obtain full-name information. To mitigate this risk, it is recommended to upgrade to the latest version of Moodle or apply the relevant security patches. Regularly updating Moodle installations is crucial to ensure the security and privacy of user data. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for moodle/moodle →
FAQ
Moodle is an open-source learning management system (LMS) used by educational institutions to create and deliver online courses.
This vulnerability allows remote attackers to obtain sensitive full-name information, potentially leading to privacy breaches and enabling further attacks.
To fix this vulnerability, upgrade to the latest version of Moodle (2.6.11, 2.7.8, or 2.8.6) or apply the relevant security patches.
No specific workarounds are provided. It is crucial to apply the recommended fix by upgrading to the patched versions of Moodle.
For more information, refer to the official Moodle documentation or contact the Moodle support team.
References
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
