Miggo Logo
Miggo Vulnerability Database
→
CVE-2014-0217

CVE-2014-0217:
Moodle does not check for the moodle/course:viewhiddencourses capability

4.3

CVSS Score

Basic Information

CVE ID
CVE-2014-0217
GHSA ID
GHSA-c3vx-v4x8-x894
EPSS Score
0.51334%
CWE
CWE-200
Published
5/13/2022
Updated
1/24/2024
KEV Status
No
Technology
TechnologyPHP

Technical Details

CVSS Vector
AV:N/AC:M/Au:N/C:P/I:N/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
moodle/moodlecomposer>= 2.6.0, < 2.6.32.6.3

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from the absence of a capability check in enrol/index.php. The patch adds a check using has_capability() to prevent unauthorized access. The original code lacked this check, making the main script in enrol/index.php the entry point for the vulnerability. The script directly handles course enrollment page logic, and the missing check allowed guests to view hidden course names and summaries. The commit diff confirms the fix was applied in this file, directly addressing the missing capability check.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

*nrol/in**x.p*p in Moo*l* *.*.x ***or* *.*.* *o*s not ****k *or t** moo*l*/*ours*:vi*w*i***n*ours*s **p**ility ***or* listin* *i***n *ours*s, w*i** *llows r*mot* *tt**k*rs to o*t*in s*nsitiv* n*m* *n* summ*ry in*orm*tion **out t**s* *ours*s *y l*v*r*

Reasoning

T** vuln*r**ility st*ms *rom t** **s*n** o* * **p**ility ****k in `*nrol/in**x.p*p`. T** p*t** ***s * ****k usin* `**s_**p**ility()` to pr*v*nt un*ut*oriz** ****ss. T** ori*in*l *o** l**k** t*is ****k, m*kin* t** m*in s*ript in `*nrol/in**x.p*p` t**