CVE-2024-43428: Moodle Cache Poisoning Vulnerability Due to Storage Injection
Summary
CVE-2024-43428: Moodle vulnerable to cache poisoning via injection into storage. Affects moodle/moodle across 4 version ranges.
< 4.1.12
>= 4.2.0-beta, < 4.2.9
>= 4.3.0-beta, < 4.3.6
>= 4.4.0-beta, < 4.4.2
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- moodle · Bitnami
The same CVE-2024-43428 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is a widely used open-source learning platform designed to provide educators, administrators, and learners with a single robust, secure, and integrated system to create personalized learning environments. It offers features such as course management, user management, and a variety of plugins to enhance functionality. However, Moodle has been found vulnerable to cache poisoning, which can lead to unauthorized data manipulation and potential security breaches.
Vulnerability Detail
The vulnerability arises from insufficient validation of data stored in the cache, allowing attackers to inject malicious data into the local storage. This can lead to cache poisoning, where the integrity of the cached data is compromised. The potential ramifications include unauthorized access to sensitive information, disruption of service, and the ability to execute arbitrary code, which can severely impact the security and reliability of the Moodle platform.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 4.1.124.1.12composer require moodle/moodle:4.1.12 -
>= 4.2.0-beta, < 4.2.94.2.9composer require moodle/moodle:4.2.9 -
>= 4.3.0-beta, < 4.3.64.3.6composer require moodle/moodle:4.3.6 -
>= 4.4.0-beta, < 4.4.24.4.2composer require moodle/moodle:4.4.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users can implement additional validation checks on the data being stored in the cache to prevent malicious injections. This can be done by sanitizing inputs and ensuring that only expected data formats are accepted before caching.
Conclusion
The Moodle cache poisoning vulnerability (CVE-2024-43428) poses a significant risk to users by allowing attackers to inject malicious data into the cache. It is crucial for users to update to the latest patched versions to mitigate this risk and ensure the security of their learning environments.
See every vulnerability recorded for moodle/moodle →
FAQ
Cache poisoning is a type of attack where an attacker injects malicious data into a cache, leading to the delivery of compromised data to users.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to analyze your composer.lock file without any signup.
The consequences include unauthorized access to sensitive information, potential data manipulation, and disruption of services, which can severely impact users and administrators.
While the primary risk is data manipulation and unauthorized access, there is a potential for data loss if malicious actions are executed successfully.
It is recommended to regularly check for updates and apply security patches as soon as they are released to protect against vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
