CVE-2019-10154: Moodle - All Messaging Conversations Could Be Viewed
Summary
CVE-2019-10154: Moodle all messaging conversations could be viewed. Affects moodle/moodle versions >= 3.6, < 3.6.4. Fixed in 3.6.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Moodle is an open-source learning management system (LMS) widely used for creating and delivering online courses. It provides a platform for educators to create interactive learning environments and engage with students. Moodle allows users to communicate through messaging conversations, enabling private discussions between individuals or groups. However, a vulnerability has been discovered in Moodle versions before 3.7 and 3.6.4 that allows unauthorized access to all messaging conversations.
Vulnerability Detail
The flaw in Moodle's messaging system arises from a web service that fetches messages without proper restrictions on the current user's conversations. This means that an attacker can exploit this vulnerability to view all messaging conversations, even those they are not authorized to access. The impact of this vulnerability is significant as it compromises the privacy and confidentiality of conversations, potentially exposing sensitive information shared within the Moodle platform.
How To Fix
Minimum fixed version
3.6.4
This is the first release that contains the fix.
composer require moodle/moodle:3.6.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by upgrading Moodle to the patched version.
Conclusion
The discovered vulnerability in Moodle versions before 3.7 and 3.6.4 allows unauthorized access to all messaging conversations, posing a significant risk to the privacy and confidentiality of users. It is crucial to upgrade Moodle to version 3.6.4 or later to mitigate this vulnerability. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for moodle/moodle →
FAQ
Moodle is an open-source learning management system (LMS) used for creating and delivering online courses.
Moodle versions before 3.7 and 3.6.4 are affected.
The vulnerability allows unauthorized access to all messaging conversations, compromising the privacy and confidentiality of discussions.
Upgrade Moodle to version 3.6.4 or later to implement the necessary access controls and prevent unauthorized access to messaging conversations.
No, there is no known workaround. Upgrading to the patched version is the recommended solution.
References
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
