CVE-2016-2158: Moodle - Sensitive Category-Detail Information Disclosure
Summary
CVE-2016-2158: Moodle allows attackers to obtain sensitive category-detail information. Affects moodle/moodle across 4 version ranges.
< 2.7.13
>= 2.8.0, < 2.8.11
>= 2.9.0, < 2.9.5
>= 3.0.0, < 3.0.3
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning management system (LMS) widely used for creating and managing online courses. It provides various features for educators and learners, including course management, content creation, and communication tools. Moodle is written in PHP and utilizes a modular architecture to support extensibility and customization. However, a vulnerability has been discovered in Moodle versions 2.6.11 through 3.0.3 that allows attackers to obtain sensitive category-detail information.
Vulnerability Detail
The vulnerability exists in the 'lib/ajax/getnavbranch.php' file of Moodle when the 'forcelogin' feature is enabled. This feature allows administrators to require users to log in before accessing any content. However, due to a flaw in the implementation, remote attackers can exploit the 'guest' role to retrieve sensitive category-detail information from the navigation branch. By making a specially crafted Ajax request, an attacker can bypass the login requirement and gain access to category details that should be restricted. This information disclosure can potentially expose sensitive data and compromise the confidentiality of the system.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.7.132.7.13composer require moodle/moodle:2.7.13 -
>= 2.8.0, < 2.8.112.8.11composer require moodle/moodle:2.8.11 -
>= 2.9.0, < 2.9.52.9.5composer require moodle/moodle:2.9.5 -
>= 3.0.0, < 3.0.33.0.3composer require moodle/moodle:3.0.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround is to disable the 'forcelogin' feature in Moodle. By disabling this feature, the vulnerability can be mitigated until a proper upgrade can be performed. To disable 'forcelogin', administrators can navigate to the Moodle site administration settings and modify the authentication settings accordingly.
Conclusion
The vulnerability in Moodle versions 2.6.11 through 3.0.3 allows remote attackers to obtain sensitive category-detail information. To mitigate this issue, it is recommended to upgrade to the latest version of Moodle (2.7.13, 2.8.11, 2.9.5, or 3.0.3). If immediate upgrading is not possible, administrators can disable the 'forcelogin' feature as a temporary workaround. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for moodle/moodle →
FAQ
Moodle is an open-source learning management system (LMS) used for creating and managing online courses.
The 'forcelogin' feature in Moodle allows administrators to require users to log in before accessing any content.
The vulnerability in Moodle allows remote attackers to obtain sensitive category-detail information, potentially compromising the confidentiality of the system.
Yes, the vulnerability has been fixed in Moodle versions 2.7.13, 2.8.11, 2.9.5, and 3.0.3.
If upgrading is not immediately feasible, you can disable the 'forcelogin' feature in Moodle as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
