Moodle: Read SCORM Contents Vulnerability
Summary
CVE-2015-5341: Moodle allows attackers to read SCORM contents. Affects moodle/moodle across 3 version ranges.
< 2.7.11
>= 2.8.0, < 2.8.9
>= 2.9.0, < 2.9.3
Fixed in 2.7.11, 2.8.9 or 2.9.3, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning management system (LMS) used by educational institutions and organizations to create and deliver online courses. It provides a platform for educators to create interactive content, assessments, and collaborative learning environments. The mod_scorm module in Moodle allows users to import and manage SCORM (Sharable Content Object Reference Model) packages, which are a common standard for e-learning content. SCORM packages typically contain multimedia elements, quizzes, and other interactive content.
Vulnerability Detail
The mod_scorm module in Moodle versions prior to 2.7.11, 2.8.9, and 2.9.3 mishandles availability dates, which can be exploited by remote authenticated users to bypass access restrictions and read SCORM contents. This vulnerability allows unauthorized access to sensitive educational materials, potentially compromising the integrity and confidentiality of the content. The exact vectors of exploitation are unspecified.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.7.112.7.11composer require moodle/moodle:2.7.11 -
>= 2.8.0, < 2.8.92.8.9composer require moodle/moodle:2.8.9 -
>= 2.9.0, < 2.9.32.9.3composer require moodle/moodle:2.9.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by upgrading Moodle to the patched versions.
Conclusion
The read SCORM contents vulnerability in Moodle can be mitigated by upgrading to the patched versions. It is crucial to promptly apply the recommended fix to ensure the security and integrity of educational materials. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for moodle/moodle →
FAQ
Moodle is an open-source learning management system (LMS) used for creating and delivering online courses.
The mod_scorm module in Moodle allows users to import and manage SCORM packages, which contain e-learning content.
SCORM (Sharable Content Object Reference Model) is a standard for creating e-learning content that can be shared across different learning management systems.
This vulnerability allows unauthorized users to bypass access restrictions and read SCORM contents, potentially compromising the confidentiality and integrity of educational materials.
To fix this vulnerability, upgrade Moodle to version 2.7.11, 2.8.9, or 2.9.3, depending on the installed version.
References
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
