CVE-2018-1044: Moodle Privilege escalation in quiz web services
Summary
CVE-2018-1044: Moodle Privilege escalation in quiz web services. Affects moodle/moodle across 4 version ranges.
>= 3.1, < 3.1.10
>= 3.2, < 3.2.7
>= 3.3, < 3.3.4
>= 3.4, < 3.4.1
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning management system widely used in educational institutions. It provides various features for creating and managing online courses, including a quiz module. The quiz web services in Moodle allow students to access and view quiz results. However, in certain cases, this functionality can be exploited to bypass the settings and allow unauthorized access to quiz results.
Vulnerability Detail
The vulnerability (CVE-2018-1044) in Moodle 3.x quiz web services enables students to view quiz results even when it is prohibited in the settings. This privilege escalation issue can lead to unauthorized access to sensitive information, such as correct answers and scores. It poses a moderate risk as it requires a user with lower privileges to exploit the vulnerability.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 3.1, < 3.1.103.1.10composer require moodle/moodle:3.1.10 -
>= 3.2, < 3.2.73.2.7composer require moodle/moodle:3.2.7 -
>= 3.3, < 3.3.43.3.4composer require moodle/moodle:3.3.4 -
>= 3.4, < 3.4.13.4.1composer require moodle/moodle:3.4.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. It is advised to apply the recommended fix by upgrading to the patched versions of Moodle.
Conclusion
The vulnerability in Moodle's quiz web services allows students to bypass settings and view quiz results, potentially compromising the integrity of assessments and exposing sensitive information. It is crucial for Moodle users to upgrade to the patched versions mentioned in this advisory to mitigate the risk of unauthorized access to quiz results. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for moodle/moodle →
FAQ
The vulnerability allows students to view quiz results even when it is prohibited, potentially compromising the integrity of the assessment process and exposing sensitive information.
Users of Moodle versions 3.1 to 3.4 are affected by this vulnerability. It primarily impacts educational institutions and organizations using Moodle as their learning management system.
There is no known public exploit available for this vulnerability at the time of this advisory.
The recommended mitigation is to upgrade to the patched versions of Moodle as mentioned in the 'How to Fix' section.
Yes, the CVSS score for this vulnerability is 4.3, indicating a moderate severity level.
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
