CVE-2017-2643: Moodle Global search displays user names for unauthenticated users
Summary
CVE-2017-2643: Moodle Global search displays user names for unauthenticated users. Affects moodle/moodle versions >= 3.2, < 3.2.2. Fixed in 3.2.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning management system (LMS) used by educational institutions worldwide. It provides a platform for creating and managing online courses, allowing educators to deliver content and engage with students. One of Moodle's features is the global search functionality, which allows users to search for various resources within the LMS. However, in Moodle version 3.2.x, there is a vulnerability that exposes user names to unauthenticated users through the global search feature.
Vulnerability Detail
The vulnerability in Moodle 3.2.x allows unauthenticated users to view user names through the global search functionality. This can potentially lead to privacy breaches and expose sensitive information about users. The issue originates from a flaw in the implementation of the global search feature, which fails to properly restrict access to user names for unauthenticated users. As a result, anyone with access to the global search feature can retrieve user names without proper authentication. The vulnerability has a CVSS score of 5.3, indicating a moderate severity level.
How To Fix
Minimum fixed version
3.2.2
This is the first release that contains the fix.
composer require moodle/moodle:3.2.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, administrators can disable the global search feature in Moodle until the upgrade to version 3.2.2 or later is performed. This can be achieved by modifying the Moodle configuration to remove or disable the global search functionality. However, it is important to note that disabling the global search feature may impact the overall user experience and limit the search capabilities within Moodle.
Conclusion
In conclusion, the vulnerability in Moodle 3.2.x allows unauthenticated users to view user names through the global search feature, potentially leading to privacy breaches. It is crucial for administrators to upgrade to Moodle version 3.2.2 or later to mitigate this vulnerability. Alternatively, the global search feature can be temporarily disabled as a workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for moodle/moodle →
FAQ
Moodle is an open-source learning management system (LMS) used by educational institutions worldwide. It provides a platform for creating and managing online courses.
The global search feature in Moodle allows users to search for various resources within the learning management system. It provides a convenient way to find specific content or activities.
The vulnerability in Moodle 3.2.x exposes user names to unauthenticated users through the global search feature. This can potentially lead to privacy breaches and expose sensitive information about users.
The vulnerability has a CVSS score of 5.3, indicating a moderate severity level.
To fix the vulnerability, it is recommended to upgrade to Moodle version 3.2.2 or later. The Moodle development team has addressed the issue by implementing proper access controls for user names in the global search feature.
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
