CVE-2024-43431: Moodle Badge Deletion Vulnerability Due to IDOR
Summary
CVE-2024-43431: Moodle's IDOR in badges allows deletion of arbitrary badges. Affects moodle/moodle across 4 version ranges.
< 4.1.12
>= 4.2.0-beta, < 4.2.9
>= 4.3.0-beta, < 4.3.6
>= 4.4.0-beta, < 4.4.2
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- moodle · Bitnami
The same CVE-2024-43431 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Moodle is an open-source learning platform designed to provide educators, administrators, and learners with a single robust, secure, and integrated system to create personalized learning environments. It offers a wide range of features including course management, user management, and a variety of plugins to enhance functionality. However, a recent vulnerability has been identified that allows unauthorized deletion of badges, which are used to recognize achievements within the platform.
Vulnerability Detail
A vulnerability was discovered in Moodle related to insufficient capability checks in the badge management system. This Insecure Direct Object Reference (IDOR) issue allows users to delete badges that they do not have permission to access. The ramifications of this vulnerability include potential data loss and disruption of the user experience, as badges are often used to signify accomplishments and progress within the learning environment. Attackers could exploit this vulnerability to maliciously remove badges from other users, undermining the integrity of the platform.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 4.1.124.1.12composer require moodle/moodle:4.1.12 -
>= 4.2.0-beta, < 4.2.94.2.9composer require moodle/moodle:4.2.9 -
>= 4.3.0-beta, < 4.3.64.3.6composer require moodle/moodle:4.3.6 -
>= 4.4.0-beta, < 4.4.24.4.2composer require moodle/moodle:4.4.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, administrators can restrict user permissions related to badge management until the update is applied. This can be done by reviewing and adjusting the roles and capabilities assigned to users in the Moodle settings.
Conclusion
The vulnerability identified as CVE-2024-43431 in Moodle poses a significant risk by allowing unauthorized badge deletions. It is crucial for users to update their installations to the latest patched versions to mitigate this risk. Additionally, implementing temporary restrictions on user permissions can help protect against potential exploitation until the update is completed.
See every vulnerability recorded for moodle/moodle →
FAQ
CVE-2024-43431 is a vulnerability in Moodle that allows unauthorized deletion of badges due to insufficient capability checks.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which monitors vulnerabilities using your composer.lock file.
The consequences include potential data loss and the ability for malicious users to delete badges from other users, affecting the integrity of the learning environment.
You can update Moodle by running the command 'composer require moodle/moodle:^4.1.12' or 'composer require moodle/moodle:^4.4.2' depending on your version.
Yes, you can temporarily restrict user permissions related to badge management in the Moodle settings.
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
