CVE-2016-2151: Moodle allows attackers to discover student e-mail addresses
Summary
CVE-2016-2151: Moodle allows attackers to discover student e-mail addresses. Affects moodle/moodle across 4 version ranges.
< 2.7.13
>= 2.8.0, < 2.8.11
>= 2.9.0, < 2.9.5
>= 3.0.0, < 3.0.3
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning management system (LMS) used by educational institutions to create and manage online courses. It provides a platform for teachers and students to interact, share resources, and collaborate on assignments. Moodle is widely adopted and offers various features such as course management, grading, discussion forums, and user management. However, a vulnerability has been discovered in Moodle versions 2.6.11 through 2.9.5 and 3.0.3, which allows attackers to discover student e-mail addresses.
Vulnerability Detail
The vulnerability exists in the 'user/index.php' file of Moodle. It is caused by excessive authorization granted based on the 'moodle/course:viewhiddenuserfields' capability. This vulnerability can be exploited by remote authenticated users with the teacher role. By reading the Participants list, these users can leverage their privileges to discover student e-mail addresses. This information disclosure can potentially lead to privacy breaches and targeted attacks against students.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.7.132.7.13composer require moodle/moodle:2.7.13 -
>= 2.8.0, < 2.8.112.8.11composer require moodle/moodle:2.8.11 -
>= 2.9.0, < 2.9.52.9.5composer require moodle/moodle:2.9.5 -
>= 3.0.0, < 3.0.33.0.3composer require moodle/moodle:3.0.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround is to disable the 'moodle/course:viewhiddenuserfields' capability for the teacher role. This can be done by modifying the role permissions in the Moodle administration settings. By removing this capability, teachers will no longer have the privilege to view hidden user fields, including student e-mail addresses.
Conclusion
The discovered vulnerability in Moodle allows attackers to access student e-mail addresses, posing privacy risks and potential targeted attacks. It is crucial to upgrade to the patched versions or apply the workaround to mitigate this issue. For further assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for moodle/moodle →
FAQ
Moodle is an open-source learning management system used by educational institutions for online course management and collaboration.
The vulnerability affects Moodle versions 2.6.11 through 2.9.5 and 3.0.3.
Remote authenticated users with the teacher role can exploit this vulnerability.
The vulnerability allows attackers to discover student e-mail addresses, which can lead to privacy breaches and targeted attacks against students.
To fix this vulnerability, upgrade to Moodle versions 2.7.13, 2.8.11, 2.9.5, or 3.0.3. Alternatively, disable the 'moodle/course:viewhiddenuserfields' capability for the teacher role.
References
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
