CVE-2019-14883

Vulnerability

Details

In Moodle 3.6 before 3.6.7 and 3.7 before 3.7.3, tokens used to fetch inline attachments in email notifications were not properly invalidated when a user's account became inactive. [1] This oversight means that even after an account is disabled, the tokens within previously sent email bodies remain valid for retrieving the associated files. [3]

Exploitation

Scenario

To exploit this vulnerability, an attacker would need both the token and the file path. [1] Since the token is embedded in the email notification, a user who still has access to the email (e.g., in their mailbox) can use the token to access the files without being logged into Moodle. The attack does not require authentication to the platform, only possession of the token and knowledge of the server's file structure.

Impact

An attacker who obtains a valid token and file path can retrieve any inline attachment originally sent in email notifications, potentially exposing sensitive user data or course materials. [1] This could lead to unauthorized disclosure of information.

Mitigation

The vulnerability has been patched in Moodle 3.6.7 and 3.7.3. [1] Administrators are advised to upgrade to these versions or later to ensure tokens are revoked upon account deactivation. [3] The Moodle project maintains the fix in the official repository. [2]