CVE-2016-2155: Moodle - Modify "Exclude grade" settings
Summary
CVE-2016-2155: Moodle allows attackers to modify "Exclude grade" settings. Affects moodle/moodle across 3 version ranges.
>= 2.8.0, < 2.8.11
>= 2.9.0, < 2.9.5
>= 3.0.0, < 3.0.3
Fixed in 2.8.11, 2.9.5 or 3.0.3, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Moodle is an open-source learning management system (LMS) used by educational institutions to create and manage online courses. It provides various features for instructors and students to interact and collaborate. The grade-reporting feature in Singleview (aka Single View) is a component of Moodle that allows instructors to manage and report student grades. However, a vulnerability in Moodle versions 2.8.x, 2.9.x, and 3.0.x allows remote authenticated users to modify the "Exclude grade" settings without proper authorization.
Vulnerability Detail
The vulnerability arises from the grade-reporting feature in Singleview not considering the moodle/grade:manage capability. This oversight enables remote authenticated users, specifically those with the Non-Editing Instructor role, to manipulate the "Exclude grade" settings. By leveraging this vulnerability, attackers can modify the grade settings, potentially leading to grade manipulation and unauthorized access to student information.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 2.8.0, < 2.8.112.8.11composer require moodle/moodle:2.8.11 -
>= 2.9.0, < 2.9.52.9.5composer require moodle/moodle:2.9.5 -
>= 3.0.0, < 3.0.33.0.3composer require moodle/moodle:3.0.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. It is advised to apply the recommended fix by upgrading to the latest version of Moodle.
Conclusion
The vulnerability in Moodle versions 2.8.x, 2.9.x, and 3.0.x allows remote authenticated users to modify the "Exclude grade" settings without proper authorization. Upgrading to the latest version of Moodle is the recommended solution to address this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for moodle/moodle →
FAQ
Moodle is an open-source learning management system (LMS) used by educational institutions to create and manage online courses.
The grade-reporting feature in Singleview is a component of Moodle that allows instructors to manage and report student grades.
Users of Moodle versions 2.8.x, 2.9.x, and 3.0.x are affected by this vulnerability.
By exploiting this vulnerability, an attacker can modify the "Exclude grade" settings, potentially manipulating grades and gaining unauthorized access to student information.
To fix this vulnerability, it is recommended to upgrade to the latest version of Moodle.
References
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
