CVE-2019-10134: Moodle Private files uploaded via incoming mail processing could bypass quota restrictions
Summary
CVE-2019-10134: Moodle Private files uploaded via incoming mail processing could bypass quota restrictions. Affects moodle/moodle across 4 version ranges.
>= 3.1, < 3.1.18
>= 3.4, < 3.4.9
>= 3.5, < 3.5.6
>= 3.6, < 3.6.4
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning management system (LMS) used by educational institutions to create and manage online courses. It provides a platform for educators to deliver content, interact with students, and assess their progress. Moodle allows users to upload private files, which are typically subject to quota restrictions to ensure efficient storage management. However, a vulnerability in versions before 3.7, 3.6.4, 3.5.6, 3.4.9, and 3.1.18 allowed users to bypass these quota restrictions when uploading files via email.
Vulnerability Detail
The vulnerability in Moodle allowed users to exceed their quota allowance by uploading private files via email without proper size checks. This means that users could upload files larger than their allocated quota, potentially leading to storage capacity issues and impacting the overall system performance. The vulnerability has a CVSS score of 4.2, indicating a moderate severity level.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 3.1, < 3.1.183.1.18composer require moodle/moodle:3.1.18 -
>= 3.4, < 3.4.93.4.9composer require moodle/moodle:3.4.9 -
>= 3.5, < 3.5.63.5.6composer require moodle/moodle:3.5.6 -
>= 3.6, < 3.6.43.6.4composer require moodle/moodle:3.6.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended solution is to upgrade to the fixed versions of Moodle.
Conclusion
In conclusion, the vulnerability in Moodle allowed users to bypass quota restrictions when uploading private files via email. To mitigate this issue, it is crucial to upgrade to the fixed versions of Moodle. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for moodle/moodle →
FAQ
Moodle is an open-source learning management system (LMS) used by educational institutions to create and manage online courses.
The vulnerability allows users to bypass quota restrictions and upload files larger than their allocated quota, potentially causing storage capacity issues and impacting system performance.
Versions before 3.7, 3.6.4, 3.5.6, 3.4.9, and 3.1.18 are affected by this vulnerability.
To fix this vulnerability, upgrade to the fixed versions of Moodle: 3.6.4, 3.5.6, 3.4.9, or 3.1.18.
There is no specific workaround mentioned for this vulnerability. Upgrading to the fixed versions is the recommended solution.
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
