Moodle Improper Access Control
Summary
CVE-2016-3733: Moodle Improper Access Control. Affects moodle/moodle across 4 version ranges.
>= 2.7, < 2.7.14
>= 2.8, < 2.8.12
>= 2.9, < 2.9.6
>= 3.0, < 3.0.4
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Moodle is an open-source learning management system (LMS) used by educational institutions worldwide. It provides a platform for creating and managing online courses, allowing teachers to interact with students and deliver educational content. Moodle is widely adopted due to its flexibility, scalability, and extensive feature set. However, a vulnerability has been identified in Moodle versions 2.7 through 3.0.3 that allows remote authenticated users to overwrite the course idnumber. This vulnerability can potentially lead to unauthorized access and manipulation of course data.
Vulnerability Detail
The vulnerability in Moodle arises from an improper access control issue in the 'restore teacher' feature. This feature allows teachers to restore a course from a backup file. However, due to a lack of proper access controls, remote authenticated users can exploit this feature to overwrite the course idnumber. By manipulating the idnumber, an attacker can potentially gain unauthorized access to courses or modify course data. This vulnerability has a CVSS score of 4.3, indicating a moderate severity level.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 2.7, < 2.7.142.7.14composer require moodle/moodle:2.7.14 -
>= 2.8, < 2.8.122.8.12composer require moodle/moodle:2.8.12 -
>= 2.9, < 2.9.62.9.6composer require moodle/moodle:2.9.6 -
>= 3.0, < 3.0.43.0.4composer require moodle/moodle:3.0.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, administrators can disable the 'restore teacher' feature until the Moodle instance is updated to a patched version. This can be done by modifying the Moodle configuration to remove or restrict access to the 'restore teacher' functionality. Here is an example of how to disable the feature by modifying the 'config.php' file:
$CFG->disable_restore_teacher = true;
Please note that this is only a temporary solution, and upgrading to a patched version is strongly recommended.
Conclusion
The Moodle Improper Access Control vulnerability allows remote authenticated users to overwrite the course idnumber, potentially leading to unauthorized access and manipulation of course data. It is crucial to upgrade to the latest patched version of Moodle to mitigate this vulnerability. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for moodle/moodle →
FAQ
Moodle is an open-source learning management system (LMS) used by educational institutions to create and manage online courses.
The 'restore teacher' feature in Moodle allows teachers to restore a course from a backup file.
The vulnerability allows remote authenticated users to overwrite the course idnumber, potentially leading to unauthorized access and manipulation of course data.
The vulnerability has a CVSS score of 4.3, indicating a moderate severity level.
To fix the vulnerability, it is recommended to upgrade to the latest patched version of Moodle (2.7.14, 2.8.12, 2.9.6, or 3.0.4) that includes the necessary fixes.
References
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
