CVE-2019-10188: Improper Access Control in moodle/moodle
Summary
CVE-2019-10188: moodle Improper Access Control. Affects moodle/moodle across 3 version ranges.
< 3.5.7
>= 3.6.0, < 3.6.5
>= 3.7.0, < 3.7.1
Fixed in 3.5.7, 3.6.5 or 3.7.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning management system (LMS) used by educational institutions to create and deliver online courses. It provides a platform for teachers to create quizzes and manage student groups within those quizzes. Moodle versions before 3.7.1, 3.6.5, and 3.5.7 are affected by an improper access control vulnerability.
Vulnerability Detail
The vulnerability allows teachers in a quiz group to modify group overrides for other groups in the same quiz. This means that a teacher from one group can potentially change settings or access permissions for another group, leading to unauthorized access or privilege escalation. The vulnerability has a CVSS score of 4.0, indicating a moderate severity level.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 3.5.73.5.7composer require moodle/moodle:3.5.7 -
>= 3.6.0, < 3.6.53.6.5composer require moodle/moodle:3.6.5 -
>= 3.7.0, < 3.7.13.7.1composer require moodle/moodle:3.7.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended solution is to apply the available patches by updating Moodle to the fixed versions.
Conclusion
In conclusion, the improper access control vulnerability in Moodle versions before 3.7.1, 3.6.5, and 3.5.7 allows teachers to modify group overrides for other groups in the same quiz. It is important to update Moodle to the fixed versions to mitigate the risk of unauthorized access or privilege escalation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for moodle/moodle →
FAQ
Moodle is an open-source learning management system used by educational institutions to create and deliver online courses.
The vulnerability allows teachers in a quiz group to modify group overrides for other groups in the same quiz, potentially leading to unauthorized access or privilege escalation.
Versions before 3.7.1, 3.6.5, and 3.5.7 are affected by this vulnerability.
To fix the vulnerability, update Moodle to version 3.7.1, 3.6.5, or 3.5.7, depending on the installed version.
There is no specific workaround mentioned for this vulnerability. Updating to the fixed versions is the recommended solution.
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
