CVE-2021-40694: Moodle - Insufficient Escaping of LaTeX Preamble
Summary
CVE-2021-40694: Insufficient escaping of the LaTeX preamble made it possible for site administrators to read files available to the HTTP server system account. Affects moodle across 3 version ranges.
< 3.9.10
>= 3.10.0, < 3.10.7
>= 3.11.0, < 3.11.3
Fixed in 3.9.10, 3.10.7 or 3.11.3, depending on the release line you run. How to fix ↓
Also tracked for
- moodle/moodle · Packagist
The same CVE-2021-40694 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning management system widely used for creating online courses and educational platforms. It provides a range of features for educators and learners, including content management, assessments, and collaborative tools. Moodle is developed and maintained by the Moodle Project and has a large user community. However, a vulnerability has been identified in Moodle that allows site administrators to read files accessible to the HTTP server system account.
Vulnerability Detail
The vulnerability (CVE-2021-40694) in Moodle arises from insufficient escaping of the LaTeX preamble. This flaw enables site administrators to access files that are available to the HTTP server system account. By exploiting this vulnerability, an attacker with administrative privileges can potentially gain unauthorized access to sensitive information stored on the server. The impact of this vulnerability can vary depending on the files accessible to the server account, but it poses a significant risk to the confidentiality of data stored within the Moodle instance.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 3.9.103.9.10 -
>= 3.10.0, < 3.10.73.10.7 -
>= 3.11.0, < 3.11.33.11.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, administrators can disable the use of LaTeX in Moodle until the system is updated to a patched version. This can be achieved by modifying the Moodle configuration to prevent the rendering of LaTeX formulas. The specific steps to implement this workaround may vary depending on the Moodle installation and configuration. It is recommended to consult the official Moodle documentation or seek assistance from the Moodle community for guidance on implementing this workaround.
Conclusion
The vulnerability in Moodle (CVE-2021-40694) exposes sensitive files to site administrators, potentially leading to unauthorized access to confidential information. It is crucial for administrators to update their Moodle installations to the recommended patched versions to mitigate this vulnerability. Additionally, disabling the use of LaTeX as a temporary workaround can help protect the system until the update is applied. For further assistance and support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for moodle →
FAQ
The vulnerability allows site administrators to read files accessible to the HTTP server system account, potentially exposing sensitive information stored on the server.
Any Moodle instance running versions prior to 3.9.10, 3.10.7, or 3.11.3 is affected by this vulnerability.
No, this vulnerability requires administrative privileges within the Moodle instance to be exploited.
There are no known instances of this vulnerability being exploited in the wild at the time of this report.
Yes, updating Moodle to version 3.9.10, 3.10.7, or 3.11.3 will address this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for moodle.
