Moodle: Bypassing Access Restrictions
Summary
CVE-2015-5342: Moodle allows attackers to bypass intended access restrictions. Affects moodle/moodle across 3 version ranges.
< 2.7.11
>= 2.8.0, < 2.8.9
>= 2.9.0, < 2.9.3
Fixed in 2.7.11, 2.8.9 or 2.9.3, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Moodle is an open-source learning management system (LMS) used by educational institutions to create and deliver online courses. It provides a platform for educators to manage course content, interact with students, and track their progress. Moodle is widely adopted and offers a range of features to support online learning. However, a vulnerability has been identified in Moodle that allows remote authenticated users to bypass intended access restrictions.
Vulnerability Detail
The vulnerability exists in the choice module of Moodle versions 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3. It enables remote authenticated users to bypass access restrictions by visiting a specific URL, which allows them to add or delete responses even when the choice module is in the closed state. This vulnerability poses a moderate risk as it can potentially lead to unauthorized access and manipulation of course-related data.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.7.112.7.11composer require moodle/moodle:2.7.11 -
>= 2.8.0, < 2.8.92.8.9composer require moodle/moodle:2.8.9 -
>= 2.9.0, < 2.9.32.9.3composer require moodle/moodle:2.9.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, administrators can disable the choice module or restrict access to the affected URLs. Disabling the module will prevent users from exploiting the vulnerability, but it may impact the functionality of courses that rely on the choice module. Restricting access to the URLs can be achieved through server configuration or firewall rules.
Conclusion
The identified vulnerability in Moodle allows remote authenticated users to bypass access restrictions in the choice module. It is crucial for administrators to upgrade their Moodle installations to the recommended versions to mitigate the risk of unauthorized access and data manipulation. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for moodle/moodle →
FAQ
Moodle is an open-source learning management system used by educational institutions to create and deliver online courses.
The choice module in Moodle allows instructors to create polls or surveys for students to respond to.
The vulnerability allows remote authenticated users to bypass access restrictions and manipulate responses in the choice module, potentially leading to unauthorized access and data manipulation.
The vulnerability is rated as moderate, with a CVSS score of 4.3.
Administrators should upgrade Moodle to the recommended versions (2.7.11, 2.8.9, or 2.9.3) that include patches for the access restriction bypass issue.
References
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
