CVE-2016-7038: Moodle Weak Password Recovery Mechanism for Forgotten Password
Summary
CVE-2016-7038: Moodle Weak Password Recovery Mechanism for Forgotten Password. Affects moodle/moodle across 4 version ranges.
>= 2.7, < 2.7.16
>= 2.9, < 2.9.8
>= 3.0, < 3.0.6
>= 3.1, < 3.1.2
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning management system (LMS) used by educational institutions to create and deliver online courses. It provides a wide range of features for course management, content creation, and student engagement. Moodle is written in PHP and relies on a database to store user information and course data. The vulnerability identified as CVE-2016-7038 affects Moodle versions 2.x and 3.x. It specifically relates to the weak password recovery mechanism for forgotten passwords.
Vulnerability Detail
The vulnerability arises from the fact that web service tokens in Moodle are not invalidated when a user changes their password or is forced to change it. This means that even after a password change, an attacker with access to a valid web service token can continue to access the user's account and perform unauthorized actions. This vulnerability poses a significant risk as it allows an attacker to bypass the password-based authentication system and gain unauthorized access to sensitive user data or perform malicious activities on behalf of the compromised user.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 2.7, < 2.7.162.7.16composer require moodle/moodle:2.7.16 -
>= 2.9, < 2.9.82.9.8composer require moodle/moodle:2.9.8 -
>= 3.0, < 3.0.63.0.6composer require moodle/moodle:3.0.6 -
>= 3.1, < 3.1.23.1.2composer require moodle/moodle:3.1.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, Moodle administrators can manually revoke web service tokens for users who have changed their passwords. This can be done by accessing the Moodle administration interface and navigating to the user management section. From there, administrators can locate the affected user and revoke their web service token. However, this workaround is not scalable for large deployments and should only be used as a temporary measure until a permanent fix is implemented.
Conclusion
The weak password recovery mechanism in Moodle poses a significant security risk as it allows an attacker to bypass the password-based authentication system. Moodle administrators should take immediate action to invalidate web service tokens when a user changes their password and prompt users to regenerate their tokens. Failure to address this vulnerability could result in unauthorized access to sensitive user data and potential misuse of user accounts. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for moodle/moodle →
FAQ
Moodle is an open-source learning management system used by educational institutions to create and deliver online courses.
The vulnerability affects Moodle versions 2.x and 3.x.
The vulnerability allows an attacker with a valid web service token to access a user's account and perform unauthorized actions.
Yes, a fix is available for this vulnerability. Moodle administrators should ensure that web service tokens are invalidated when a user changes their password.
Yes, this vulnerability can be exploited remotely if an attacker has access to a valid web service token.
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
