CVE-2019-3849: Moodle Users could elevate their role when accessing the LTI tool on a provider site
Summary
CVE-2019-3849: Moodle Users could elevate their role when accessing the LTI tool on a provider site. Affects moodle/moodle across 3 version ranges.
< 3.4.8
>= 3.5, < 3.5.5
>= 3.6, < 3.6.3
Fixed in 3.4.8, 3.5.5 or 3.6.3, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning management system (LMS) used by educational institutions to create and manage online courses. It provides a platform for teachers and students to interact, share resources, and participate in various activities. Moodle is widely used and offers a range of features to support online learning. However, a vulnerability has been discovered in versions 3.6.3, 3.5.5, and 3.4.8 of Moodle that allows users to assign themselves an escalated role within courses or content accessed via the Learning Tools Interoperability (LTI) tool. LTI is a standard for integrating external tools and content into learning management systems, allowing users to access external resources seamlessly. This vulnerability can be exploited by modifying the request to the LTI publisher site, potentially leading to unauthorized access and privilege escalation.
Vulnerability Detail
The vulnerability in Moodle versions 3.6.3, 3.5.5, and 3.4.8 allows users to elevate their role within courses or content accessed via the LTI tool. By modifying the request to the LTI publisher site, users can assign themselves an escalated role, granting them unauthorized access and privileges. This can have serious ramifications, as users with elevated roles may gain unrestricted access to sensitive information, manipulate course content, or disrupt the learning environment. The vulnerability has a CVSS score of 8.8, indicating a high severity level.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 3.4.83.4.8composer require moodle/moodle:3.4.8 -
>= 3.5, < 3.5.53.5.5composer require moodle/moodle:3.5.5 -
>= 3.6, < 3.6.33.6.3composer require moodle/moodle:3.6.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended solution is to upgrade to the patched versions of Moodle.
Conclusion
In conclusion, Moodle versions 3.6.3, 3.5.5, and 3.4.8 are vulnerable to a privilege escalation issue when accessing the LTI tool on a provider site. Users can assign themselves an escalated role by modifying the request to the LTI publisher site, potentially leading to unauthorized access and privilege escalation. It is crucial to upgrade to the latest patched versions of Moodle to mitigate this vulnerability and ensure the security of the online learning environment. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for moodle/moodle →
FAQ
Moodle is an open-source learning management system (LMS) used by educational institutions to create and manage online courses.
The Learning Tools Interoperability (LTI) tool is a standard for integrating external tools and content into learning management systems, allowing users to access external resources seamlessly.
This vulnerability can be exploited by modifying the request to the LTI publisher site, allowing users to assign themselves an escalated role within courses or content accessed via the LTI tool.
The vulnerability can lead to unauthorized access and privilege escalation, allowing users to gain unrestricted access to sensitive information, manipulate course content, or disrupt the learning environment.
The vulnerability has a CVSS score of 8.8, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
