CVE-2015-5338: Moodle multiple cross-site request forgery (CSRF) vulnerabilities
Summary
CVE-2015-5338: Moodle multiple cross-site request forgery (CSRF) vulnerabilities. Affects moodle/moodle across 3 version ranges.
< 2.7.11
>= 2.8.0, < 2.8.9
>= 2.9.0, < 2.9.3
Fixed in 2.7.11, 2.8.9 or 2.9.3, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning management system (LMS) used by educational institutions to create and manage online courses. It provides a platform for educators to deliver content, interact with students, and assess their progress. Moodle is widely adopted and offers various modules to enhance the learning experience. However, it is susceptible to multiple cross-site request forgery (CSRF) vulnerabilities.
Vulnerability Detail
The identified vulnerabilities exist in the lesson module of Moodle versions 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3. These vulnerabilities allow remote attackers to hijack the authentication of arbitrary users for requests to specific endpoints. The affected endpoints are 'mod/lesson/mediafile.php' and 'mod/lesson/view.php'. Exploiting these vulnerabilities could lead to unauthorized access and potential misuse of user accounts and data.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.7.112.7.11composer require moodle/moodle:2.7.11 -
>= 2.8.0, < 2.8.92.8.9composer require moodle/moodle:2.8.9 -
>= 2.9.0, < 2.9.32.9.3composer require moodle/moodle:2.9.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users can implement additional security measures such as enforcing strong passwords, enabling two-factor authentication, and regularly monitoring user activity for any suspicious behavior. However, these workarounds do not address the root cause of the vulnerabilities and should be considered temporary solutions until the software is updated.
Conclusion
The identified vulnerabilities in Moodle's lesson module pose a significant security risk, allowing attackers to hijack user authentication and potentially compromise user accounts and data. It is crucial for Moodle administrators to promptly upgrade to the fixed versions to ensure the security of their Moodle instances. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for moodle/moodle →
FAQ
Moodle is an open-source learning management system (LMS) used by educational institutions to create and manage online courses.
Cross-site request forgery (CSRF) vulnerabilities allow attackers to trick authenticated users into performing unintended actions on a web application.
Remote attackers can exploit these vulnerabilities by tricking users into visiting malicious websites or clicking on specially crafted links, leading to unauthorized actions being performed on their behalf.
Exploiting these vulnerabilities can result in unauthorized access to user accounts, data leakage, and potential misuse of the affected Moodle instance.
There have been no specific reports of these vulnerabilities being actively exploited in the wild. However, it is crucial to apply the recommended fixes to mitigate any potential risks.
References
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
