Improper Role Check in Moodle Package Leads to User Information Exposure
Summary
CVE-2010-1617: Moodle doesn't properly check role. Affects moodle/moodle across 2 version ranges.
>= 1.8.0, < 1.8.12
>= 1.9.0, < 1.9.8
Fixed in 1.8.12 or 1.9.8, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Moodle is an open-source learning platform designed to provide educators, administrators, and learners with a single robust, secure, and integrated system to create personalized learning environments. It offers a wide range of features such as course management, user management, and reporting tools. However, certain versions of Moodle are vulnerable to an issue where role checks are not properly enforced, allowing unauthorized access to user information.
Vulnerability Detail
The vulnerability exists in the user/view.php file of Moodle versions 1.8.x before 1.8.12 and 1.9.x before 1.9.8. It fails to adequately verify user roles, which permits remote authenticated users to access the full names of other users through the course profile page. This could lead to privacy concerns and unauthorized information disclosure, potentially affecting user trust and data integrity.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 1.8.0, < 1.8.121.8.12composer require moodle/moodle:1.8.12 -
>= 1.9.0, < 1.9.81.9.8composer require moodle/moodle:1.9.8
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, administrators can restrict access to the course profile page or limit the visibility of user information until the update is applied. This can be done by adjusting the role permissions in the Moodle settings.
Conclusion
The improper role check vulnerability in Moodle poses a risk of unauthorized access to user information. It is crucial for users of affected versions to update to the latest patched versions to safeguard user privacy and maintain data integrity. Implementing temporary workarounds can help mitigate risks until the update is applied.
See every vulnerability recorded for moodle/moodle →
FAQ
Moodle versions 1.8.x before 1.8.12 and 1.9.x before 1.9.8 are affected.
Remote authenticated users can access the full names of other users through the course profile page.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The vulnerability may lead to unauthorized access to user information, raising privacy concerns and potentially damaging user trust.
Yes, you can restrict access to the course profile page or limit user information visibility through role permissions as a temporary measure.
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
