CVE-2021-20283: Missing permission check in Moodle
Summary
CVE-2021-20283: Missing permission check in Moodle. Affects moodle/moodle across 4 version ranges.
< 3.5.17
>= 3.8.0, < 3.8.8
>= 3.9.0, < 3.9.5
>= 3.10.0, < 3.10.2
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- moodle · Bitnami
The same CVE-2021-20283 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning management system (LMS) used by educational institutions to create and manage online courses. It provides various features for course administration, content creation, and student engagement. Moodle is widely adopted and used by organizations worldwide. However, a vulnerability has been identified in Moodle versions 3.10.2, 3.9.5, 3.8.8, and 3.5.17.
Vulnerability Detail
The vulnerability in Moodle allows the web service responsible for fetching other users' enrolled courses to be accessed without proper permission checks. This means that an unauthorized user could retrieve information about courses they are not supposed to have access to. The lack of validation in the requesting user's permissions could lead to a breach of confidentiality and unauthorized access to sensitive course data. The vulnerability has a CVSS score of 4.3, indicating a moderate severity level.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 3.5.173.5.17composer require moodle/moodle:3.5.17 -
>= 3.8.0, < 3.8.83.8.8composer require moodle/moodle:3.8.8 -
>= 3.9.0, < 3.9.53.9.5composer require moodle/moodle:3.9.5 -
>= 3.10.0, < 3.10.23.10.2composer require moodle/moodle:3.10.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround can be implemented by disabling the affected web service or restricting access to it. This can be done by modifying the Moodle configuration or using access control mechanisms at the network level. However, it is strongly advised to upgrade to the patched version as soon as possible to fully address the vulnerability.
Conclusion
The vulnerability in Moodle versions 3.10.2, 3.9.5, 3.8.8, and 3.5.17 allows unauthorized users to access course information without proper permission checks. To mitigate this vulnerability, it is crucial to upgrade to the latest patched version of Moodle. If immediate upgrading is not possible, implementing a temporary workaround by disabling the affected web service or restricting access can provide some protection. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for moodle/moodle →
FAQ
Moodle is an open-source learning management system used for creating and managing online courses.
The vulnerability affects Moodle versions 3.10.2, 3.9.5, 3.8.8, and 3.5.17.
The vulnerability allows unauthorized users to access information about courses they are not supposed to have access to, potentially leading to a breach of confidentiality and unauthorized access to sensitive course data.
To fix this vulnerability, it is recommended to upgrade to the latest patched version of Moodle (3.10.2, 3.9.5, 3.8.8, or 3.5.17).
A temporary workaround can be implemented by disabling the affected web service or restricting access to it. However, upgrading to the patched version is strongly advised.
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
