CVE-2019-14883: Moodle Email media URL tokens were not checking for user status
Summary
CVE-2019-14883: Moodle Email media URL tokens were not checking for user status. Affects moodle/moodle across 2 version ranges.
>= 3.6, < 3.6.7
>= 3.7, < 3.7.3
Fixed in 3.6.7 or 3.7.3, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Moodle is an open-source learning management system (LMS) used by educational institutions to create and deliver online courses. It provides various features for course management, content creation, and communication. Moodle versions 3.6 before 3.6.7 and 3.7 before 3.7.3 are affected by a vulnerability where tokens used to fetch inline attachments in email notifications were not disabled when a user's account was no longer active.
Vulnerability Detail
The vulnerability in Moodle allows tokens for fetching inline attachments in email notifications to remain active even after a user's account has been deactivated. This means that if an attacker knows the file path, they can access the files associated with the deactivated user's account. Although the attacker would need to know the specific file path, this vulnerability still poses a risk to the confidentiality of sensitive information stored in Moodle.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 3.6, < 3.6.73.6.7composer require moodle/moodle:3.6.7 -
>= 3.7, < 3.7.33.7.3composer require moodle/moodle:3.7.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The vulnerability in Moodle versions 3.6 before 3.6.7 and 3.7 before 3.7.3 allows unauthorized access to files associated with deactivated user accounts. To mitigate this vulnerability, it is recommended to upgrade to the latest versions of Moodle. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for moodle/moodle →
FAQ
Moodle is an open-source learning management system used for creating and delivering online courses.
Moodle versions 3.6 before 3.6.7 and 3.7 before 3.7.3 are affected.
This vulnerability allows unauthorized access to files associated with deactivated user accounts, potentially compromising the confidentiality of sensitive information.
Upgrade to Moodle version 3.6.7 or later for Moodle 3.6 users, and version 3.7.3 or later for Moodle 3.7 users.
No specific workaround has been mentioned for this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
