CVE-2015-5268: Moodle mishandles group-based authorization checks
Summary
CVE-2015-5268: Moodle mishandles group-based authorization checks. Affects moodle/moodle across 3 version ranges.
< 2.7.10
>= 2.8.0, < 2.8.8
>= 2.9.0, < 2.9.2
Fixed in 2.7.10, 2.8.8 or 2.9.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Moodle is an open-source learning management system (LMS) used by educational institutions worldwide. It provides a platform for creating and managing online courses, allowing educators to deliver content, interact with students, and assess their progress. Moodle is widely adopted due to its flexibility, extensibility, and community support. However, a vulnerability has been identified in Moodle versions 2.6.11 through 2.9.2 that mishandles group-based authorization checks.
Vulnerability Detail
The vulnerability in Moodle allows remote authenticated users to obtain sensitive information by reading a rating value. Specifically, the rating component in Moodle does not properly handle group-based authorization checks. This flaw enables authenticated users to access rating values that they should not have permission to view. By exploiting this vulnerability, an attacker could gain access to sensitive information, potentially compromising the privacy and integrity of the system.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.7.102.7.10composer require moodle/moodle:2.7.10 -
>= 2.8.0, < 2.8.82.8.8composer require moodle/moodle:2.8.8 -
>= 2.9.0, < 2.9.22.9.2composer require moodle/moodle:2.9.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to the latest version of Moodle is not immediately feasible, a temporary workaround can be implemented. Administrators can disable the rating feature in Moodle until the system can be upgraded. This can be done by modifying the Moodle configuration to remove or disable the rating functionality. However, it is important to note that this workaround is not a permanent solution and upgrading to the latest version is still recommended.
Conclusion
The vulnerability in Moodle versions 2.6.11 through 2.9.2, which mishandles group-based authorization checks, can allow authenticated users to obtain sensitive information. Upgrading to the latest version of Moodle or temporarily disabling the rating feature are recommended solutions. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for moodle/moodle →
FAQ
Moodle is an open-source learning management system used by educational institutions to create and manage online courses.
The vulnerability allows authenticated users to access sensitive information by reading rating values, potentially compromising the privacy and integrity of the system.
To fix this vulnerability, it is recommended to upgrade to the latest version of Moodle (2.7.10, 2.8.8, or 2.9.2).
Yes, administrators can temporarily disable the rating feature in Moodle until the system can be upgraded.
There is no information available regarding active exploitation of this vulnerability at this time.
References
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
