Moodle External function mod_assign_save_submission does not check due dates
Summary
CVE-2016-2159: Moodle External function mod_assign_save_submission does not check due dates. Affects moodle/moodle across 4 version ranges.
>= 2.7, < 2.7.13
>= 2.8, < 2.8.11
>= 2.9, < 2.9.5
>= 3.0, < 3.0.3
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning management system (LMS) used by educational institutions to create and manage online courses. It provides a platform for teachers and students to interact, submit assignments, and track progress. The mod_assign_save_submission function in Moodle allows users to save their assignment submissions. However, a vulnerability in this function allows remote authenticated users to bypass due-date restrictions by leveraging the student role for a web-service request.
Vulnerability Detail
The vulnerability exists in the save_submission function of the mod_assign module in Moodle versions 2.6.11 through 2.9.5 and 3.0.3. When a user with the student role makes a web-service request to save their assignment submission, the function does not properly check the due dates. This allows the user to submit assignments even after the due date has passed, bypassing the intended restrictions. This vulnerability poses a moderate risk as it can lead to academic dishonesty and compromise the fairness of grading.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 2.7, < 2.7.132.7.13composer require moodle/moodle:2.7.13 -
>= 2.8, < 2.8.112.8.11composer require moodle/moodle:2.8.11 -
>= 2.9, < 2.9.52.9.5composer require moodle/moodle:2.9.5 -
>= 3.0, < 3.0.33.0.3composer require moodle/moodle:3.0.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. Users are advised to apply the available patches or update their Moodle installations to the latest versions.
Conclusion
The vulnerability in the mod_assign_save_submission function of Moodle allows users to bypass due-date restrictions and submit assignments after the deadline. It is recommended to update Moodle to the latest patched version to mitigate this vulnerability. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for moodle/moodle →
FAQ
Moodle is an open-source learning management system used by educational institutions for online course management.
The mod_assign module in Moodle is used for creating and managing assignments within courses.
The vulnerability allows users with the student role to bypass due-date restrictions and submit assignments even after the deadline has passed.
The vulnerability poses a moderate risk as it can lead to academic dishonesty and compromise the fairness of grading.
To fix this vulnerability, update your Moodle installation to the latest patched version available.
References
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
