CVE-2019-10187: Moodle Ability to delete glossary entries that belong to another glossary
Summary
CVE-2019-10187: Moodle Ability to delete glossary entries that belong to another glossary. Affects moodle/moodle across 3 version ranges.
>= 3.5, < 3.5.7
>= 3.6, < 3.6.5
>= 3.7, < 3.7.1
Fixed in 3.5.7, 3.6.5 or 3.7.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning management system (LMS) used by educational institutions worldwide. It provides a platform for creating and managing online courses, including features such as forums, quizzes, and glossaries. Glossaries in Moodle allow users to create and share entries with definitions and explanations. However, a vulnerability has been discovered in versions before 3.7.1, 3.6.5, and 3.5.7, which allows users with permission to delete entries from a glossary to delete entries from other glossaries they do not have direct access to.
Vulnerability Detail
The vulnerability in Moodle allows users to delete glossary entries that belong to another glossary. This means that a user with the permission to delete entries from a glossary can maliciously delete entries from other glossaries they do not have direct access to. This can lead to the loss of important information and disrupt the collaborative nature of glossaries in Moodle. The vulnerability has a CVSS score of 4.3, indicating a moderate severity level.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 3.5, < 3.5.73.5.7composer require moodle/moodle:3.5.7 -
>= 3.6, < 3.6.53.6.5composer require moodle/moodle:3.6.5 -
>= 3.7, < 3.7.13.7.1composer require moodle/moodle:3.7.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. It is advised to upgrade to the patched versions of Moodle as mentioned in the 'how_to_fix' section.
Conclusion
The vulnerability in Moodle versions before 3.7.1, 3.6.5, and 3.5.7 allows users to delete glossary entries from other glossaries they do not have direct access to. To mitigate this vulnerability, it is recommended to upgrade to the patched versions of Moodle. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for moodle/moodle →
FAQ
The vulnerability allows users to delete glossary entries from other glossaries they do not have direct access to. This can result in the loss of important information and disrupt the collaborative nature of glossaries in Moodle.
Users of Moodle versions before 3.7.1, 3.6.5, and 3.5.7 are affected by this vulnerability if they have the permission to delete entries from a glossary.
There are no known exploits for this vulnerability at the moment.
No, this vulnerability requires the user to have the necessary permissions within Moodle to delete glossary entries.
Yes, upgrading to Moodle versions 3.7.1, 3.6.5, or 3.5.7 will fix this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
