Moodle: Bypassing Login Restrictions
Summary
CVE-2015-3179: Moodle allows attackers to bypass intended login restrictions. Affects moodle/moodle across 3 version ranges.
< 2.6.11
>= 2.7.0, < 2.7.8
>= 2.8.0, < 2.8.6
Fixed in 2.6.11, 2.7.8 or 2.8.6, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning management system (LMS) used by educational institutions worldwide. It provides a platform for creating and managing online courses, facilitating communication between teachers and students, and tracking student progress. Moodle is written in PHP and relies on a database to store course content, user information, and system settings. However, a vulnerability has been discovered in Moodle that allows attackers to bypass intended login restrictions.
Vulnerability Detail
The vulnerability exists in the 'login/confirm.php' file in Moodle versions 2.5.9, 2.6.x (before 2.6.11), 2.7.x (before 2.7.8), and 2.8.x (before 2.8.6). It allows remote authenticated users to bypass intended login restrictions by leveraging access to an unconfirmed suspended account. This means that an attacker who has access to an unconfirmed suspended account can log in to Moodle and gain unauthorized access to the system, potentially compromising sensitive information and performing malicious actions.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.6.112.6.11composer require moodle/moodle:2.6.11 -
>= 2.7.0, < 2.7.82.7.8composer require moodle/moodle:2.7.8 -
>= 2.8.0, < 2.8.62.8.6composer require moodle/moodle:2.8.6
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. The recommended course of action is to upgrade to the latest version of Moodle as mentioned in the 'how_to_fix' section.
Conclusion
The discovered vulnerability in Moodle allows attackers to bypass login restrictions and gain unauthorized access to the system. To mitigate this risk, it is crucial to upgrade to the latest version of Moodle, which includes the necessary patches to fix the vulnerability. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for moodle/moodle →
FAQ
Moodle is an open-source learning management system used by educational institutions for online course management and communication.
Moodle versions 2.5.9, 2.6.x (before 2.6.11), 2.7.x (before 2.7.8), and 2.8.x (before 2.8.6) are affected.
An attacker with access to an unconfirmed suspended account can bypass login restrictions and gain unauthorized access to Moodle.
The vulnerability allows unauthorized access to Moodle, potentially compromising sensitive information and enabling malicious actions.
No specific workaround is provided. Upgrading to the latest version of Moodle is the recommended solution.
References
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
