CVE-2024-1439: Moodle Improper Access Control vulnerability
Summary
CVE-2024-1439: Moodle Improper Access Control vulnerability. Affects moodle/moodle versions < 4.2.0. No fix is published. How to fix ↓
Also tracked for
- moodle · Bitnami
The same CVE-2024-1439 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is a Learning Management System (LMS) that provides a platform for educational institutions to create and manage online courses. It is widely used by schools, universities, and organizations to facilitate e-learning. Moodle allows users to create events on the calendar, which can be viewed by other users. However, an improper access control vulnerability has been identified in Moodle, which could allow a local user with a student role to create arbitrary events intended for users with higher roles. Additionally, the attacker could add events to the calendar of all users without their consent.
Vulnerability Detail
The inadequate access control vulnerability in Moodle LMS allows a user with a student role to bypass the intended restrictions and create events meant for higher role users. This can lead to unauthorized access and manipulation of the calendar system. By exploiting this vulnerability, an attacker can add events to the calendar of all users without their consent, potentially disrupting their schedules and causing confusion. The impact of this vulnerability is moderate, as it requires a local user with a student role to exploit it.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update Moodle to the latest version to ensure the proper access control is in place.
Conclusion
Inadequate access control in Moodle LMS allows a local user with a student role to create unauthorized events on the calendar of higher role users and all users without their consent. To mitigate this vulnerability, it is crucial to update Moodle to version 4.2.1 or later. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for moodle/moodle →
FAQ
Moodle is a Learning Management System (LMS) used by educational institutions to create and manage online courses.
The vulnerability allows a local user with a student role to create unauthorized events on the calendar of higher role users and all users without their consent.
Users of Moodle versions 0 to 4.2.0 are affected by this vulnerability.
Yes, the vulnerability has been fixed in Moodle version 4.2.1. Users are advised to update their installations to the latest version.
No, there is no known workaround for this vulnerability. Updating to the latest version is the recommended solution.
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
