CVE-2019-10188

Vulnerability

Overview

A flaw in Moodle's quiz activity allowed teachers assigned to a specific group to modify group overrides for other groups within the same quiz [1]. This occurred because the permission checks did not properly enforce group membership or the accessallgroups capability, enabling a teacher to alter time limits, attempt limits, or other quiz settings for groups they did not belong to [3].

Exploitation

Conditions

To exploit this vulnerability, an attacker must have a teacher role in a course that uses group overrides for quizzes. The teacher must be assigned to at least one group in the quiz, but the flaw allows them to modify overrides for any other group in the same quiz. No special network position or additional authentication is required beyond the teacher's existing credentials [1][3].

Impact

A malicious teacher could change quiz overrides for other groups, potentially extending time limits, increasing attempt numbers, or altering grading settings for students in those groups. This could give an unfair advantage or disrupt the intended quiz conditions for other students, undermining the integrity of the assessment [1].

Mitigation

The vulnerability is fixed in Moodle versions 3.7.1, 3.6.5, and 3.5.7. Administrators should upgrade to these or later versions. No workaround is documented, and the issue is not known to be exploited in the wild [1][3].