CVE-2017-7489: Moodle External blog editing takeover
Summary
CVE-2017-7489: Moodle External blog editing takeover. Affects moodle/moodle across 4 version ranges.
>= 2.7, < 2.7.20
>= 3.0, < 3.0.10
>= 3.1, < 3.1.6
>= 3.2, < 3.2.3
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning management system used by educational institutions to create and manage online courses. It provides a platform for educators to deliver content, interact with students, and assess their progress. Moodle is widely adopted and offers various features to enhance the learning experience.
However, Moodle versions 2.x and 3.x are vulnerable to an issue that allows remote authenticated users to take ownership of arbitrary blogs by editing an external blog link.
Vulnerability Detail
The vulnerability in Moodle allows authenticated users to exploit an external blog editing feature to gain control over any blog. By modifying an external blog link, an attacker can take ownership of the blog and potentially manipulate its content. This can lead to unauthorized access, data manipulation, and potential privacy breaches. The vulnerability has a CVSS score of 6.3, indicating a moderate severity level.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 2.7, < 2.7.202.7.20composer require moodle/moodle:2.7.20 -
>= 3.0, < 3.0.103.0.10composer require moodle/moodle:3.0.10 -
>= 3.1, < 3.1.63.1.6composer require moodle/moodle:3.1.6 -
>= 3.2, < 3.2.33.2.3composer require moodle/moodle:3.2.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. It is essential to apply the recommended patches or upgrades to mitigate the risk effectively.
Conclusion
The vulnerability in Moodle allows authenticated users to take over arbitrary blogs by editing external blog links. To mitigate this risk, it is crucial to upgrade to the patched versions of Moodle. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for moodle/moodle →
FAQ
Moodle is an open-source learning management system used by educational institutions to create and manage online courses.
Moodle versions 2.x and 3.x are affected by this vulnerability.
By exploiting this vulnerability, an attacker can take ownership of arbitrary blogs and potentially manipulate their content.
The vulnerability has a CVSS score of 6.3, indicating a moderate severity level.
To fix this vulnerability, it is recommended to upgrade to the patched versions of Moodle.
References
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
