CVE-2015-5265: Moodle allows attackers to delete files
Summary
CVE-2015-5265: Moodle allows attackers to delete files. Affects moodle/moodle across 3 version ranges.
>= 2.7.0, < 2.7.10
>= 2.8.0, < 2.8.8
>= 2.9.0, < 2.9.2
Fixed in 2.7.10, 2.8.8 or 2.9.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning management system (LMS) used by educational institutions to create and manage online courses. It provides various features such as course management, user management, content creation, and collaboration tools. Moodle versions prior to 2.9.2 are affected by a vulnerability in the wiki component. This vulnerability allows remote authenticated users to delete arbitrary files by exploiting a flaw in the file management authorization process.
Vulnerability Detail
The vulnerability in Moodle's wiki component arises from a failure to consider the 'mod/wiki:managefiles' capability before authorizing file management. This oversight enables remote authenticated users to delete any files by utilizing a 'manage-files' button in a text editor. By exploiting this vulnerability, an attacker can maliciously delete important files, potentially causing data loss or disrupting the functionality of the affected Moodle instance.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 2.7.0, < 2.7.102.7.10composer require moodle/moodle:2.7.10 -
>= 2.8.0, < 2.8.82.8.8composer require moodle/moodle:2.8.8 -
>= 2.9.0, < 2.9.22.9.2composer require moodle/moodle:2.9.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, administrators can disable the wiki component in Moodle until the system can be upgraded to a patched version. This can be done by navigating to the Moodle administration panel, selecting the 'Plugins' section, and disabling the 'Wiki' plugin. Disabling the plugin will prevent users from accessing the wiki functionality, effectively mitigating the risk of file deletion through this vulnerability.
Conclusion
In conclusion, Moodle versions prior to 2.9.2 are vulnerable to an issue that allows remote authenticated users to delete arbitrary files. Upgrading to the latest version of Moodle or disabling the wiki component can mitigate this vulnerability. For further assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for moodle/moodle →
FAQ
Moodle is an open-source learning management system used for creating and managing online courses.
Moodle versions prior to 2.9.2 are affected by this vulnerability.
An attacker with remote authenticated access can exploit this vulnerability by using the 'manage-files' button in a text editor to delete arbitrary files.
This vulnerability allows attackers to delete important files, potentially causing data loss or disrupting the functionality of the affected Moodle instance.
To fix this vulnerability, it is recommended to upgrade Moodle to version 2.9.2 or later.
References
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
