CVE-2016-2154: Moodle - Discover Hidden Course Names
Summary
CVE-2016-2154: Moodle allows attackers to discover hidden course names. Affects moodle/moodle across 3 version ranges.
>= 2.8.0, < 2.8.11
>= 2.9.0, < 2.9.5
>= 3.0.0, < 3.0.3
Fixed in 2.8.11, 2.9.5 or 3.0.3, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning management system (LMS) used by educational institutions to create and manage online courses. It provides a platform for educators to deliver content, interact with students, and track their progress. Moodle is widely adopted and offers a range of features to support online learning. However, a vulnerability has been identified in versions 2.8.x to 2.8.11, 2.9.x to 2.9.5, and 3.0.x to 3.0.3 of Moodle that allows remote authenticated users to discover hidden course names by subscribing to a rule in the Event Monitor tool.
Vulnerability Detail
The vulnerability arises from a flaw in the Event Monitor tool in Moodle. The tool does not consider the 'moodle/course:viewhiddencourses' capability, which should restrict access to hidden course names. As a result, authenticated users can exploit this oversight and subscribe to a rule that reveals the hidden course names. This can lead to a breach of privacy and compromise the confidentiality of sensitive course information. The impact of this vulnerability is considered moderate, with a CVSS score of 4.3.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 2.8.0, < 2.8.112.8.11composer require moodle/moodle:2.8.11 -
>= 2.9.0, < 2.9.52.9.5composer require moodle/moodle:2.9.5 -
>= 3.0.0, < 3.0.33.0.3composer require moodle/moodle:3.0.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended upgrades to mitigate the risk effectively.
Conclusion
The identified vulnerability in Moodle allows authenticated users to discover hidden course names, potentially compromising the privacy and confidentiality of sensitive course information. It is crucial to apply the recommended upgrades to ensure the protection of hidden course names. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for moodle/moodle →
FAQ
Moodle is an open-source learning management system (LMS) used by educational institutions to create and manage online courses.
The Event Monitor tool in Moodle allows administrators to monitor and track events within the LMS, such as user activity and system events.
This vulnerability allows authenticated users to discover hidden course names, compromising the privacy and confidentiality of sensitive course information.
The vulnerability is considered moderate, with a CVSS score of 4.3.
To fix this vulnerability, it is recommended to upgrade to the latest version of Moodle as specified in the 'how_to_fix' section.
References
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
