Quantitative Risk Assessment in Moodle Learning Management System

Abstract

For the past decade, in many educational institutes, learning management systems have become essential parts to deliver class materials and to provide communicational channels between course instructors and students. When institutes are adopting a learning management system, perhaps the two most concerning points would be how much a system costs to deploy and how secure a system is. Moodle, which is the most popular open software learning management system, satisfies a budget-related issue. Thus, as a low-cost solution, educational institutes often adopt Moodle. However, there have been few studies investigating the security aspects of Moodle, which might be more important than a budget problem. Here, we quantitatively investigate how secure Moodle system is. First, vulnerabilities discovered in Moodle are speculated with respect to the CVSS score. Then we apply a well-known vulnerability discovery model into the vulnerability discovery process. Also, we investigate whether there are seasonal variations in the discovery process. The result shows that a reasonably modified datasets are well followed the discovery model, and there is indeed a seasonal pattern in the Moodle vulnerability dataset.