CVE-2024-43433: Moodle User Management Vulnerability for Suspended Users
Summary
CVE-2024-43433: Moodle's user/power level management inconsistent with suspended users. Affects moodle/moodle across 2 version ranges.
>= 4.3.0, < 4.3.6
>= 4.4.0, < 4.4.2
Fixed in 4.3.6 or 4.4.2, depending on the release line you run. How to fix ↓
Also tracked for
- moodle · Bitnami
The same CVE-2024-43433 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning platform designed to provide educators, administrators, and learners with a single robust, secure, and integrated system to create personalized learning environments. It supports various functionalities such as course management, user enrollment, and communication tools. However, it has been identified that the user and power level management system does not consistently handle suspended users, leading to potential security issues.
Vulnerability Detail
A flaw was found in Moodle's handling of user power levels and room memberships for suspended users. When a user is suspended, their membership and power levels in Matrix rooms are not correctly applied or revoked, which could allow suspended users to retain access to functionalities and information they should no longer have. This inconsistency poses a security risk as it undermines the intended restrictions placed on suspended accounts, potentially leading to unauthorized access to sensitive information.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 4.3.0, < 4.3.64.3.6composer require moodle/moodle:4.3.6 -
>= 4.4.0, < 4.4.24.4.2composer require moodle/moodle:4.4.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is advisable to monitor user accounts closely and manually revoke access for suspended users until the update can be applied.
Conclusion
The vulnerability identified as CVE-2024-43433 in Moodle poses a risk to user management, particularly for suspended accounts. It is crucial for users to update to the latest patched versions to mitigate this risk. Regular monitoring and manual intervention are recommended until the update can be applied.
See every vulnerability recorded for moodle/moodle →
FAQ
CVE-2024-43433 is a vulnerability in Moodle that affects how suspended users are managed in terms of their power levels and room memberships.
The primary risk is that suspended users may retain access to features and information they should not have, leading to unauthorized access and potential data breaches.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate update is not possible, closely monitor suspended user accounts and manually revoke their access to sensitive areas until the patch can be applied.
The CVSS score of this vulnerability is 5.3, indicating a low severity level.
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
