CVE-2018-16854: Moodle Login CSRF vulnerability in login form
Summary
CVE-2018-16854: Moodle Login CSRF vulnerability in login form. Affects moodle/moodle across 4 version ranges.
>= 3.1, < 3.1.15
>= 3.3, < 3.3.9
>= 3.4, < 3.4.6
>= 3.5, < 3.5.3
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning management system (LMS) used by educational institutions to create and manage online courses. It provides various features for course administration, content creation, and student engagement. Moodle versions 3.5 to 3.5.2, 3.4 to 3.4.5, 3.3 to 3.3.8, 3.1 to 3.1.14, and earlier are affected by a Login CSRF vulnerability. This vulnerability allows an attacker to forge a malicious login request, potentially leading to unauthorized access to user accounts and sensitive information.
Vulnerability Detail
The login form in Moodle is vulnerable to cross-site request forgery (CSRF) attacks. The form does not include a token to protect against CSRF, making it possible for an attacker to trick a user into submitting a login request without their knowledge or consent. This can result in the attacker gaining unauthorized access to the user's account and performing actions on their behalf. The impact of this vulnerability is high, as it can lead to unauthorized access, data leakage, and potential compromise of the entire Moodle instance.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 3.1, < 3.1.153.1.15composer require moodle/moodle:3.1.15 -
>= 3.3, < 3.3.93.3.9composer require moodle/moodle:3.3.9 -
>= 3.4, < 3.4.63.4.6composer require moodle/moodle:3.4.6 -
>= 3.5, < 3.5.33.5.3composer require moodle/moodle:3.5.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended solution is to upgrade to the fixed versions of Moodle.
Conclusion
The Moodle Login CSRF vulnerability in the login form can lead to unauthorized access and potential compromise of user accounts and sensitive information. It is crucial to upgrade to the fixed versions of Moodle to mitigate this vulnerability. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for moodle/moodle →
FAQ
Moodle is an open-source learning management system (LMS) used by educational institutions to create and manage online courses.
A CSRF vulnerability allows an attacker to forge malicious requests on behalf of a user, potentially leading to unauthorized actions or access.
The affected versions of Moodle include 3.5 to 3.5.2, 3.4 to 3.4.5, 3.3 to 3.3.8, 3.1 to 3.1.14, and earlier.
The impact of this vulnerability is high, as it can lead to unauthorized access, data leakage, and potential compromise of the entire Moodle instance.
To protect your Moodle instance, it is recommended to upgrade to the fixed versions of Moodle, which include 3.6, 3.5.3, 3.4.6, 3.3.9, and 3.1.15.
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
