CVE-2018-1043: Moodle Setting for blocked hosts list bypass vulnerability
Summary
CVE-2018-1043: Moodle Setting for blocked hosts list can be bypassed with multiple A record hostnames. Affects moodle/moodle across 3 version ranges.
>= 3.2, < 3.2.7
>= 3.3, < 3.3.4
>= 3.4, < 3.4.1
Fixed in 3.2.7, 3.3.4 or 3.4.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning management system widely used for creating online educational platforms. It provides various features and functionalities for instructors and students to interact and manage courses. The Moodle package, specifically versions 3.2 to 3.4, is affected by a vulnerability that allows bypassing the blocked hosts list setting.
Vulnerability Detail
The vulnerability in Moodle 3.x allows an attacker to bypass the blocked hosts list by using multiple A record hostnames. This means that even if certain hosts are blocked in the Moodle configuration, an attacker can still access the platform by using different hostnames. This vulnerability can potentially lead to unauthorized access and compromise of sensitive data within the Moodle system.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 3.2, < 3.2.73.2.7composer require moodle/moodle:3.2.7 -
>= 3.3, < 3.3.43.3.4composer require moodle/moodle:3.3.4 -
>= 3.4, < 3.4.13.4.1composer require moodle/moodle:3.4.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. It is crucial to apply the recommended fix by upgrading to the patched versions of Moodle.
Conclusion
The vulnerability in Moodle's blocked hosts list setting can be exploited by using multiple A record hostnames. To mitigate this vulnerability, it is crucial to upgrade to the patched versions of Moodle (3.2.7, 3.3.4, or 3.4.1). For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for moodle/moodle →
FAQ
Moodle is an open-source learning management system used for creating online educational platforms.
Versions 3.2 to 3.4 of Moodle are affected by this vulnerability.
This vulnerability allows attackers to bypass the blocked hosts list and potentially gain unauthorized access to sensitive data within the Moodle system.
To fix this vulnerability, upgrade to the patched versions of Moodle: 3.2.7, 3.3.4, or 3.4.1.
No, there is no specific workaround available. It is recommended to apply the fix by upgrading to the patched versions of Moodle.
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
