CVE-2021-40691: Shibboleth Authentication Plugin Session Hijack Risk in Moodle
Summary
CVE-2021-40691: A session hijack risk was identified in the Shibboleth authentication plugin. Affects moodle across 3 version ranges.
< 3.9.10
>= 3.10.0, < 3.10.7
>= 3.11.0, < 3.11.3
Fixed in 3.9.10, 3.10.7 or 3.11.3, depending on the release line you run. How to fix ↓
Also tracked for
- moodle/moodle · Packagist
The same CVE-2021-40691 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning management system widely used for online education. It provides a platform for educators to create and deliver courses, manage student enrollment, and facilitate communication and collaboration. The Shibboleth authentication plugin is a popular choice for integrating Moodle with Shibboleth-based identity providers, allowing users to authenticate using their institutional credentials. However, a session hijack risk has been identified in the Shibboleth authentication plugin, potentially compromising the security and privacy of user sessions.
Vulnerability Detail
The session hijack risk in the Shibboleth authentication plugin allows an attacker to hijack a user's session and impersonate them, gaining unauthorized access to their account and sensitive information. This vulnerability arises due to improper session management, which can be exploited by an attacker with network access to the affected Moodle instance. By intercepting and manipulating session cookies or session identifiers, the attacker can take control of a user's session and perform actions on their behalf. This could lead to unauthorized access, data leakage, and other malicious activities.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 3.9.103.9.10 -
>= 3.10.0, < 3.10.73.10.7 -
>= 3.11.0, < 3.11.33.11.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. It is crucial to apply the recommended fix by upgrading Moodle and the Shibboleth authentication plugin to the patched versions.
Conclusion
The session hijack risk in the Shibboleth authentication plugin for Moodle poses a significant security threat, potentially allowing unauthorized access to user accounts and sensitive information. It is crucial for administrators to promptly upgrade Moodle to the patched versions and ensure the Shibboleth authentication plugin is up to date. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for moodle →
FAQ
Moodle is an open-source learning management system used for online education. It provides a platform for educators to create and deliver courses, manage student enrollment, and facilitate communication and collaboration.
The Shibboleth authentication plugin is a popular choice for integrating Moodle with Shibboleth-based identity providers. It allows users to authenticate using their institutional credentials.
Session hijacking is a security attack where an attacker intercepts and takes control of a user's session. This allows the attacker to impersonate the user and perform actions on their behalf.
The session hijack risk in the Shibboleth authentication plugin can be exploited by an attacker with network access to the affected Moodle instance. By intercepting and manipulating session cookies or session identifiers, the attacker can take control of a user's session and perform unauthorized actions.
To fix the session hijack risk, it is recommended to upgrade Moodle to the latest version that includes the necessary security patches. Specifically, versions 3.9.10, 3.10.7, and 3.11.3 have addressed this vulnerability. Additionally, ensure that the Shibboleth authentication plugin is up to date.
References
Related vulnerabilities
Recent vulnerabilities recorded for moodle.
