A while back I wrote and submitted a patch which was went into the core Moodle codebase. You can see my name in the Moodle credits. It was about an cross-site scripting vulnerability that I found in the code. Projects like Moodle are bound to have these. Moodle is not any less secure than other systems.

Lately I’ve noticed a different type of security issue with Moodle. Information is starting to leak out of Moodle via rss and blogs. Architecturally speaking this has a lot to do with Moodle’s bazzar architecture. New features are bolted-on rather than built in (but that’s a story for another day). Here are two security flaws in Moodle versions > 1.7:

  1. Moodle system administrators assume that Moodle is secure and they will mostly link Moodle with their current institutional authentication system (such as ldap or whatever). However anyone with teacher rights can now set up a discussion forum, enable rss, publish the feed and hey presto your class is open to the public. There is no authentication on this feed. I doubt most teachers are aware of this. And I think most Moodle sys admin would freak out if they knew.
  2. Moodle blogs feature (although half-baked and not much use) creates posts that are available publicly without athenticaiton. This is less of risk than the discussions rss leak above as you might reasonably expect your blog to readable widely.