Sensitive Course-Structure Information Disclosure in Moodle
Summary
CVE-2015-3180: Moodle allows attackers to obtain sensitive course-structure information. Affects moodle/moodle across 3 version ranges.
< 2.6.11
>= 2.7.0, < 2.7.8
>= 2.8.0, < 2.8.6
Fixed in 2.6.11, 2.7.8 or 2.8.6, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning management system (LMS) used by educational institutions to create and manage online courses. It provides a platform for educators to deliver content, interact with students, and assess their progress. Moodle is widely adopted and offers various features such as course management, user enrollment, and communication tools. However, a vulnerability has been identified in Moodle versions 2.5.9 to 2.8.5 that allows remote authenticated users to obtain sensitive course-structure information.
Vulnerability Detail
The vulnerability exists in the 'lib/navigationlib.php' file of Moodle. It can be exploited by an attacker who has access to a student account with a suspended enrollment. By leveraging this access, the attacker can retrieve sensitive course-structure information. This information may include details about the course layout, modules, and resources, which could potentially compromise the integrity and confidentiality of the affected courses. The vulnerability has a moderate severity rating and is assigned CWE-200.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.6.112.6.11composer require moodle/moodle:2.6.11 -
>= 2.7.0, < 2.7.82.7.8composer require moodle/moodle:2.7.8 -
>= 2.8.0, < 2.8.62.8.6composer require moodle/moodle:2.8.6
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. The recommended solution is to upgrade to the patched versions of Moodle.
Conclusion
In conclusion, Moodle versions 2.5.9 to 2.8.5 are vulnerable to an information disclosure issue that allows remote authenticated users to obtain sensitive course-structure information. To mitigate this vulnerability, it is crucial to upgrade to the latest patched versions of Moodle. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for moodle/moodle →
FAQ
Moodle is an open-source learning management system (LMS) used by educational institutions to create and manage online courses.
The vulnerability allows remote authenticated users to obtain sensitive course-structure information, which could compromise the integrity and confidentiality of the affected courses.
To fix this vulnerability, it is recommended to upgrade to the latest version of Moodle (2.6.11, 2.7.8, or 2.8.6).
There is no specific workaround provided for this vulnerability. Upgrading to the patched versions of Moodle is the recommended solution.
The vulnerability has a moderate severity rating.
References
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
