Group-Based Access Restrictions Vulnerability in Moodle
Summary
CVE-2015-5339: Moodle does not properly implement group-based access restrictions. Affects moodle/moodle across 3 version ranges.
< 2.7.11
>= 2.8.0, < 2.8.9
>= 2.9.0, < 2.9.3
Fixed in 2.7.11, 2.8.9 or 2.9.3, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning management system (LMS) used by educational institutions to create and manage online courses. It provides a wide range of features for course administration, content creation, and student engagement. The vulnerability in question affects Moodle versions 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3. Moodle's core_enrol_get_enrolled_users web service in enrol/externallib.php does not properly implement group-based access restrictions.
Vulnerability Detail
The vulnerability allows remote authenticated users to obtain sensitive course-participant information by exploiting a flaw in the group-based access restrictions implementation. By making a web-service request, an attacker can bypass the intended access restrictions and retrieve confidential information about course participants. This information could include personally identifiable information (PII) or other sensitive data. The vulnerability has a CVSS score of 4.3, indicating a moderate severity level.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.7.112.7.11composer require moodle/moodle:2.7.11 -
>= 2.8.0, < 2.8.92.8.9composer require moodle/moodle:2.8.9 -
>= 2.9.0, < 2.9.32.9.3composer require moodle/moodle:2.9.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. However, administrators can mitigate the risk by restricting access to the affected web service (core_enrol_get_enrolled_users) or by implementing additional access controls at the network level. It is recommended to consult with Moodle's official documentation or seek assistance from Moodle's support community for further guidance on securing the system.
Conclusion
The group-based access restrictions vulnerability in Moodle exposes sensitive course-participant information to remote authenticated users. To mitigate this risk, it is crucial to update Moodle to the recommended versions and review access control settings. Administrators should follow the official Moodle documentation and seek assistance from the Moodle community for further support on vulnerability remediation. For real-time monitoring and alerting of open-source vulnerabilities, tools like Vulert can be utilized.
See every vulnerability recorded for moodle/moodle →
FAQ
Moodle is an open-source learning management system (LMS) used for creating and managing online courses.
The vulnerability affects Moodle versions 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3.
An attacker with remote authenticated access can exploit this vulnerability by making a web-service request to the core_enrol_get_enrolled_users endpoint and bypassing the group-based access restrictions.
By exploiting this vulnerability, an attacker can obtain sensitive course-participant information, which may include personally identifiable information (PII) or other confidential data.
The vulnerability has a CVSS score of 4.3, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
