CVE-2024-43427: Moodle Package Exposes Sensitive Secrets in Admin Presets Export
Summary
CVE-2024-43427: Moodle admin presets export tool includes some secrets that should not be exported. Affects moodle/moodle across 4 version ranges.
< 4.1.12
>= 4.2.0, < 4.2.9
>= 4.3.0, < 4.3.6
>= 4.4.0, < 4.4.2
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- moodle · Bitnami
The same CVE-2024-43427 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is a widely-used open-source learning platform designed to provide educators, administrators, and learners with a single robust, secure, and integrated system to create personalized learning environments. It offers a variety of features including course management, user management, and customizable themes. However, a recent vulnerability has been identified in the admin presets export tool, which inadvertently includes sensitive information that should not be shared.
Vulnerability Detail
A flaw was found in Moodle's admin presets export tool, where sensitive secrets and keys are not excluded from the export process. This oversight could lead to unintentional exposure of these secrets if the exported presets are shared with third parties. The vulnerability stems from improper handling of sensitive data during the export operation, potentially allowing unauthorized access to critical information.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 4.1.124.1.12composer require moodle/moodle:4.1.12 -
>= 4.2.0, < 4.2.94.2.9composer require moodle/moodle:4.2.9 -
>= 4.3.0, < 4.3.64.3.6composer require moodle/moodle:4.3.6 -
>= 4.4.0, < 4.4.24.4.2composer require moodle/moodle:4.4.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary measure, it is advisable to avoid exporting site administration presets until the package has been updated to a secure version. Additionally, ensure that any exported presets are not shared with untrusted parties.
Conclusion
The CVE-2024-43427 vulnerability in Moodle poses a significant risk by exposing sensitive secrets during the export of admin presets. It is crucial for users to update to the latest patched versions to mitigate this risk and protect their data.
See every vulnerability recorded for moodle/moodle →
FAQ
CVE-2024-43427 is a vulnerability in Moodle that allows sensitive secrets to be included in the admin presets export, potentially leading to data leaks.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which monitors vulnerabilities based on your composer.lock file.
If you cannot update Moodle right away, avoid exporting admin presets and ensure that any exported data is not shared with untrusted individuals.
Failing to address this vulnerability could result in unauthorized access to sensitive information, leading to potential data breaches and loss of user trust.
You can find more information about Moodle vulnerabilities on the official Moodle website or security advisories related to the package.
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
