CVE-2022-30597: Moodle - Hidden User Field Description Vulnerability
Summary
CVE-2022-30597: A flaw was found in moodle where the description user field was not hidden when being set as a hidden user field. Affects moodle across 4 version ranges.
>= 3.9.0, < 3.9.14
>= 3.10.0, < 3.10.11
>= 3.11.0, < 3.11.7
>= 4.0.0, < 4.0.1
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- moodle/moodle · Packagist
The same CVE-2022-30597 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning management system (LMS) used for creating and delivering online courses. It provides a wide range of features for educators and learners, including course management, content creation, assessments, and communication tools. Moodle is widely adopted in educational institutions and organizations worldwide. However, a vulnerability has been identified in Moodle that affects the description user field, which is not properly hidden when set as a hidden user field.
Vulnerability Detail
The vulnerability in Moodle allows the description user field to be visible even when it is intended to be hidden. This can lead to a privacy breach as sensitive information entered in the description field may be exposed to unauthorized users. The impact of this vulnerability depends on the nature of the information entered in the description field. It is important to note that this vulnerability affects Moodle versions 3.9.0 to 3.9.14, 3.10.0 to 3.10.11, and 3.11.0 to 3.11.7. Additionally, Moodle version 4.0.0 is also affected.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 3.9.0, < 3.9.143.9.14 -
>= 3.10.0, < 3.10.113.10.11 -
>= 3.11.0, < 3.11.73.11.7 -
>= 4.0.0, < 4.0.14.0.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, administrators can manually modify the Moodle code to ensure that the description user field is hidden. The following code snippet demonstrates the necessary modification:
// File: user/profile/field/description/renderer.php
public function display_data($user, $return = false) {
if ($this->field->is_hidden()) {
return '';
}
// Existing code
...
}
By adding the if ($this->field->is_hidden()) condition, the description user field will only be displayed if it is not set as a hidden user field.
Conclusion
In conclusion, the hidden user field description vulnerability in Moodle allows the description user field to be visible when it should be hidden, potentially exposing sensitive information. It is crucial to update Moodle to the latest patched version to mitigate this vulnerability. Administrators can also apply a temporary workaround by modifying the Moodle code. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for moodle →
FAQ
Moodle is an open-source learning management system (LMS) used for creating and delivering online courses. It provides a wide range of features for educators and learners, including course management, content creation, assessments, and communication tools.
The vulnerability allows the description user field to be visible even when it is intended to be hidden. This can lead to a privacy breach as sensitive information entered in the description field may be exposed to unauthorized users.
This vulnerability affects Moodle versions 3.9.0 to 3.9.14, 3.10.0 to 3.10.11, 3.11.0 to 3.11.7, and 4.0.0.
To fix this vulnerability, it is recommended to update Moodle to the latest version available. The Moodle development team has addressed this issue in versions 3.9.14, 3.10.11, 3.11.7, and later.
As a temporary workaround, administrators can manually modify the Moodle code to ensure that the description user field is hidden. The provided code snippet demonstrates the necessary modification.
Related vulnerabilities
Recent vulnerabilities recorded for moodle.
