CVE-2019-10189: Improper Access Control in moodle/moodle
Summary
CVE-2019-10189: moodle Improper Access Control. Affects moodle/moodle across 3 version ranges.
< 3.5.7
>= 3.6.0, < 3.6.5
>= 3.7.0, < 3.7.1
Fixed in 3.5.7, 3.6.5 or 3.7.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning management system (LMS) used by educational institutions to create and manage online courses. It provides a platform for teachers and students to interact, share resources, and submit assignments. The vulnerability identified as CVE-2019-10189 affects versions of Moodle prior to 3.7.1, 3.6.5, and 3.5.7. This vulnerability allows teachers in an assignment group to modify group overrides for other groups within the same assignment.
Vulnerability Detail
The vulnerability arises from an improper access control issue in Moodle. Teachers who belong to an assignment group can exploit this flaw to gain unauthorized access to group overrides of other groups in the same assignment. By modifying these overrides, teachers can potentially manipulate the grading criteria or submission deadlines for other groups, leading to unfair advantages or disruptions in the learning process.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 3.5.73.5.7composer require moodle/moodle:3.5.7 -
>= 3.6.0, < 3.6.53.6.5composer require moodle/moodle:3.6.5 -
>= 3.7.0, < 3.7.13.7.1composer require moodle/moodle:3.7.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, administrators can restrict the permissions of teachers within assignment groups. By limiting the ability to modify group overrides, the risk of unauthorized access and manipulation can be mitigated. However, this workaround may limit the flexibility and functionality of the platform, so upgrading to the patched versions is strongly advised.
Conclusion
The vulnerability identified as CVE-2019-10189 in Moodle allows teachers to improperly access and modify group overrides for other groups within the same assignment. This can lead to unfair advantages or disruptions in the learning process. It is crucial for administrators to upgrade their Moodle installations to the patched versions (3.7.1, 3.6.5, or 3.5.7) to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for moodle/moodle →
FAQ
Moodle is an open-source learning management system (LMS) used by educational institutions to create and manage online courses.
Versions of Moodle prior to 3.7.1, 3.6.5, and 3.5.7 are vulnerable to this issue.
By exploiting this vulnerability, an attacker who is a teacher in an assignment group can modify group overrides for other groups within the same assignment, potentially manipulating grading criteria or submission deadlines.
To fix this vulnerability, upgrade your Moodle installation to version 3.7.1, 3.6.5, or 3.5.7, depending on the installed version.
As a temporary workaround, administrators can restrict the permissions of teachers within assignment groups to limit their ability to modify group overrides.
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
