CVE-2024-43430: Moodle Quiz API Insufficient Access Control Vulnerability
Summary
CVE-2024-43430: Moodle has insufficient access control. Affects moodle/moodle versions >= 4.4.0, < 4.4.2. Fixed in 4.4.2. How to fix ↓
Also tracked for
- moodle · Bitnami
The same CVE-2024-43430 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is a widely used open-source learning platform designed to provide educators, administrators, and learners with a single robust, secure, and integrated system to create personalized learning environments. It offers a variety of features including course management, quizzes, and user tracking. However, a recent vulnerability has been identified in the Quiz API that allows external access to override access controls, potentially compromising user data and integrity.
Vulnerability Detail
The vulnerability arises from insufficient access control in the Moodle Quiz API, which allows external API access to override existing permissions. This flaw can lead to unauthorized access to quiz data, enabling malicious users to manipulate quiz settings or access sensitive information. The issue is classified under CWE-276, indicating a failure to enforce proper access restrictions. The severity of this vulnerability is rated low, but it poses risks to data integrity and user privacy if exploited.
How To Fix
Minimum fixed version
4.4.2
This is the first release that contains the fix.
composer require moodle/moodle:4.4.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can restrict external API access to the Quiz module by modifying the access settings in your Moodle configuration. This can help mitigate the risk until the update is applied.
Conclusion
The CVE-2024-43430 vulnerability in Moodle highlights the importance of proper access control in software applications. By updating to the latest version, users can protect their systems from potential unauthorized access and ensure the integrity of their data. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for moodle/moodle →
FAQ
CVE-2024-43430 is a vulnerability in Moodle that allows insufficient access control in the Quiz API, potentially leading to unauthorized access.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If exploited, this vulnerability could allow unauthorized users to access or manipulate quiz data, compromising user privacy and data integrity.
Yes, a patch is available in Moodle version 4.4.2. It is recommended to update to this version to mitigate the vulnerability.
If you cannot update immediately, consider restricting external API access to the Quiz module as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
