CVE-2018-1134: Moodle Improper Privilege Management
Summary
CVE-2018-1134: Moodle Improper Privilege Management. Affects moodle/moodle across 4 version ranges.
>= 3.1, < 3.1.12
>= 3.2, < 3.2.9
>= 3.3, < 3.3.6
>= 3.4, < 3.4.3
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning management system used by educational institutions to create and manage online courses. It provides various features for instructors and students, including assignment submission and portfolio export functionality. However, a vulnerability has been discovered in Moodle 3.x versions. This vulnerability allows students who have submitted assignments and exported them to portfolios to download any stored Moodle file by manipulating the download URL.
Vulnerability Detail
The vulnerability in Moodle 3.x arises from improper privilege management. Students, who should only have access to their own submitted assignments and exported files, can bypass the intended restrictions and download any Moodle file. By modifying the download URL, they can retrieve sensitive information or unauthorized files. This vulnerability poses a moderate risk and can lead to unauthorized access to confidential data or the exposure of sensitive files.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 3.1, < 3.1.123.1.12composer require moodle/moodle:3.1.12 -
>= 3.2, < 3.2.93.2.9composer require moodle/moodle:3.2.9 -
>= 3.3, < 3.3.63.3.6composer require moodle/moodle:3.3.6 -
>= 3.4, < 3.4.33.4.3composer require moodle/moodle:3.4.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. The recommended solution is to upgrade to the patched versions of Moodle as mentioned above.
Conclusion
The vulnerability in Moodle 3.x versions allows students to download unauthorized files by manipulating the download URL. To mitigate this risk, it is crucial to upgrade to the patched versions of Moodle (3.1.12, 3.2.9, 3.3.6, or 3.4.3). This will ensure that the improper privilege management issue is resolved and prevent unauthorized access to sensitive files. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for moodle/moodle →
FAQ
Moodle is an open-source learning management system used by educational institutions to create and manage online courses.
This vulnerability allows students to download any stored Moodle file by manipulating the download URL, potentially leading to unauthorized access to confidential data or exposure of sensitive files.
Moodle 3.x versions are affected by this vulnerability.
To fix this vulnerability, it is recommended to upgrade to the patched versions of Moodle: 3.1.12, 3.2.9, 3.3.6, or 3.4.3.
No specific workaround is provided for this vulnerability. Upgrading to the patched versions is the recommended solution.
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
