CVE-2024-34008: Moodle CSRF risk in analytics management of models
Summary
CVE-2024-34008: Moodle CSRF risk in analytics management of models. Affects moodle/moodle across 3 version ranges.
< 4.1.10
>= 4.2.0, < 4.2.7
>= 4.3.0, < 4.3.4
Fixed in 4.1.10, 4.2.7 or 4.3.4, depending on the release line you run. How to fix ↓
Also tracked for
- moodle · Bitnami
The same CVE-2024-34008 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning management system (LMS) used for creating and delivering online courses. It provides various features for course management, content creation, and assessment. The Moodle package, available on Packagist, is a composer package that allows users to install and manage Moodle on their systems. This vulnerability affects versions 4.1.10 to 4.3.4 of the Moodle package.
Vulnerability Detail
The vulnerability identified as CVE-2024-34008 is a Cross-Site Request Forgery (CSRF) risk in the analytics management of models in Moodle. The admin management actions for analytics models did not include the necessary token to prevent CSRF attacks. This could allow an attacker to trick an authenticated admin user into performing unintended actions on the system, potentially leading to unauthorized access, data manipulation, or other malicious activities.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 4.1.104.1.10composer require moodle/moodle:4.1.10 -
>= 4.2.0, < 4.2.74.2.7composer require moodle/moodle:4.2.7 -
>= 4.3.0, < 4.3.44.3.4composer require moodle/moodle:4.3.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The CSRF risk in the analytics management of models in Moodle can be mitigated by upgrading to the latest version of the Moodle package. It is important to stay updated with the latest security patches to ensure the integrity and security of your Moodle installation. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for moodle/moodle →
FAQ
Moodle is an open-source learning management system used for creating and delivering online courses.
A CSRF vulnerability allows an attacker to trick an authenticated user into performing unintended actions on a web application.
The CSRF vulnerability in the analytics management of models in Moodle could lead to unauthorized access, data manipulation, or other malicious activities.
You can use Vulert's playground (https://vulert.com/scanner) to check if your Moodle installation is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the composer.lock file.
You can find more information about this vulnerability in the GitHub Advisory Database (https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/05/GHSA-68x5-4jg5-gjgg/GHSA-68x5-4jg5-gjgg.json).
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
