CVE-2024-43429: Moodle Gradebook Reports User Information Exposure Vulnerability
Summary
CVE-2024-43429: Moodle has user information visibility control issues in gradebook reports. Affects moodle/moodle across 4 version ranges.
< 4.1.12
>= 4.2.0, < 4.2.9
>= 4.3.0, < 4.3.6
>= 4.4.0, < 4.4.2
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- moodle · Bitnami
The same CVE-2024-43429 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning platform designed to provide educators, administrators, and learners with a single robust, secure, and integrated system to create personalized learning environments. It is widely used in educational institutions for course management, tracking student progress, and facilitating online learning. This vulnerability affects the gradebook reports feature, which is crucial for managing and displaying student grades and performance metrics.
Vulnerability Detail
A flaw was identified in Moodle that allows certain hidden user profile fields to be visible in gradebook reports. This issue arises from inadequate visibility control, which means that users who do not possess the 'view hidden user fields' capability can still access sensitive information. The potential ramifications include unauthorized access to personal data, which could lead to privacy violations and misuse of user information.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 4.1.124.1.12composer require moodle/moodle:4.1.12 -
>= 4.2.0, < 4.2.94.2.9composer require moodle/moodle:4.2.9 -
>= 4.3.0, < 4.3.64.3.6composer require moodle/moodle:4.3.6 -
>= 4.4.0, < 4.4.24.4.2composer require moodle/moodle:4.4.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary measure, administrators can restrict access to gradebook reports or limit the visibility of user profile fields until the update is applied. This can be done by adjusting user permissions in the Moodle settings.
Conclusion
In summary, CVE-2024-43429 presents a significant risk to user privacy within Moodle's gradebook reports. It is crucial for administrators to update to the latest patched versions to mitigate this vulnerability and protect sensitive user information. Additionally, utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for moodle/moodle →
FAQ
CVE-2024-43429 is a vulnerability in Moodle that allows unauthorized visibility of hidden user profile fields in gradebook reports.
Users without the appropriate permissions may gain access to sensitive information, leading to potential privacy breaches.
The affected versions include Moodle 4.4.0 to 4.4.1, 4.3.0 to 4.3.5, 4.2.0 to 4.2.8, and all versions up to 4.1.11.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of this vulnerability is 5.3, indicating a low severity level.
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
