CVE-2017-7490: Moodle Unauthorized searching of arbitrary blogs by typing full URL
Summary
CVE-2017-7490: Moodle Unauthorized searching of arbitrary blogs by typing full url. Affects moodle/moodle across 4 version ranges.
>= 2.7, < 2.7.20
>= 3.0, < 3.0.10
>= 3.1, < 3.1.6
>= 3.2, < 3.2.3
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning management system used by educational institutions worldwide. It provides a platform for creating and managing online courses, including features such as discussion forums, assignments, and blogs. The vulnerability in question allows unauthorized users to search for and access arbitrary blogs by typing the full URL, bypassing the necessary capability check.
Vulnerability Detail
The missing capability check in Moodle 2.x and 3.x enables unauthorized users to search for and access any blog by directly entering the full URL. This can lead to unauthorized access to sensitive information and potential privacy breaches. The vulnerability has a CVSS score of 5.3, indicating a moderate severity level.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 2.7, < 2.7.202.7.20composer require moodle/moodle:2.7.20 -
>= 3.0, < 3.0.103.0.10composer require moodle/moodle:3.0.10 -
>= 3.1, < 3.1.63.1.6composer require moodle/moodle:3.1.6 -
>= 3.2, < 3.2.33.2.3composer require moodle/moodle:3.2.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, administrators can disable the blog feature in Moodle until the system is upgraded to a fixed version. This can be done by accessing the Moodle administration panel and navigating to the 'Plugins' section, where the blog plugin can be disabled.
Conclusion
The vulnerability in Moodle allows unauthorized searching and access to arbitrary blogs, potentially compromising sensitive information. It is crucial to upgrade to the fixed versions of Moodle to mitigate this vulnerability. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for moodle/moodle →
FAQ
Moodle is an open-source learning management system used by educational institutions to create and manage online courses.
The vulnerability allows unauthorized users to search for and access arbitrary blogs, potentially leading to unauthorized access to sensitive information.
Moodle versions 2.x and 3.x are affected by this vulnerability.
To fix this vulnerability, it is recommended to upgrade to the latest fixed version of Moodle.
Yes, administrators can temporarily disable the blog feature in Moodle until the system is upgraded.
References
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
