CVE-2018-10890: Moodle Exposure of Sensitive Information to an Unauthorized Actor
Summary
CVE-2018-10890: Moodle Exposure of Sensitive Information to an Unauthorized Actor. Affects moodle/moodle across 4 version ranges.
>= 3.1, < 3.1.13
>= 3.3, < 3.3.7
>= 3.4, < 3.4.4
>= 3.5, < 3.5.1
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning management system (LMS) used by educational institutions to create and deliver online courses. It provides a platform for educators to manage course content, interact with students, and track their progress. Moodle is widely adopted and offers various features to enhance the learning experience. However, a vulnerability has been identified in Moodle versions before 3.5.1, 3.4.4, 3.3.7, and 3.1.13 that exposes sensitive information to unauthorized actors. This vulnerability affects the core_course_get_categories web service, which may return hidden categories that should be omitted when fetching course categories.
Vulnerability Detail
The vulnerability in Moodle allows an unauthorized actor to access hidden categories through the core_course_get_categories web service. This can lead to the exposure of sensitive information that should remain hidden from unauthorized users. The impact of this vulnerability can vary depending on the nature of the hidden categories and the information they contain. It is important to address this vulnerability to prevent unauthorized access to sensitive data and maintain the integrity of the Moodle platform.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 3.1, < 3.1.133.1.13composer require moodle/moodle:3.1.13 -
>= 3.3, < 3.3.73.3.7composer require moodle/moodle:3.3.7 -
>= 3.4, < 3.4.43.4.4composer require moodle/moodle:3.4.4 -
>= 3.5, < 3.5.13.5.1composer require moodle/moodle:3.5.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. The recommended solution is to update Moodle to the patched versions mentioned above.
Conclusion
The vulnerability in Moodle versions before 3.5.1, 3.4.4, 3.3.7, and 3.1.13 exposes sensitive information to unauthorized actors. It is crucial to update Moodle to the recommended patched versions to mitigate the risk of unauthorized access to sensitive data. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for moodle/moodle →
FAQ
Moodle is an open-source learning management system used by educational institutions to create and deliver online courses.
The core_course_get_categories web service is a component of Moodle that allows users to fetch course categories.
This vulnerability can lead to the exposure of sensitive information that should remain hidden from unauthorized users.
To fix this vulnerability, update Moodle to the recommended patched versions.
No, the recommended solution is to update Moodle to the patched versions.
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
