CVE-2024-43434: Moodle Feedback Module CSRF Vulnerability
Summary
CVE-2024-43434: Moodle has CSRF risk in Feedback non-respondents report. Affects moodle/moodle across 4 version ranges.
< 4.1.12
>= 4.2.0-beta, < 4.2.9
>= 4.3.0-beta, < 4.3.6
>= 4.4.0-beta, < 4.4.2
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- moodle · Bitnami
The same CVE-2024-43434 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is a widely-used open-source learning platform designed to provide educators, administrators, and learners with a single robust, secure, and integrated system to create personalized learning environments. The Feedback module in Moodle allows users to create surveys and collect feedback from participants. However, a recent vulnerability has been identified in the non-respondents report feature of this module, which could potentially expose users to Cross-Site Request Forgery (CSRF) attacks.
Vulnerability Detail
The vulnerability arises from an incorrect CSRF token check in the bulk message sending feature of the Feedback module's non-respondents report. This flaw allows an attacker to forge requests on behalf of a user without their consent, leading to unauthorized actions being performed within the Moodle application. The potential ramifications include unauthorized access to sensitive user data and the ability to send messages to users without their knowledge, which could compromise user privacy and security.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 4.1.124.1.12composer require moodle/moodle:4.1.12 -
>= 4.2.0-beta, < 4.2.94.2.9composer require moodle/moodle:4.2.9 -
>= 4.3.0-beta, < 4.3.64.3.6composer require moodle/moodle:4.3.6 -
>= 4.4.0-beta, < 4.4.24.4.2composer require moodle/moodle:4.4.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users can limit access to the Feedback module or disable the bulk messaging feature until the update is applied. This can help mitigate the risk of CSRF attacks while waiting for the official patch.
Conclusion
The CSRF vulnerability identified in Moodle's Feedback module poses significant risks to user security and privacy. It is crucial for users to update their installations to the latest patched versions to mitigate these risks. Utilizing tools like Vulert can further enhance security by providing real-time monitoring for vulnerabilities.
See every vulnerability recorded for moodle/moodle →
FAQ
A CSRF vulnerability allows an attacker to trick a user into executing unwanted actions on a web application in which they are authenticated, potentially compromising their account.
You can use Vulert's playground to check if your application is affected by this vulnerability without any signup. Visit Vulert Scanner for more information.
Failing to address this vulnerability could lead to unauthorized actions being taken on behalf of users, potentially exposing sensitive information and compromising user accounts.
It is recommended to regularly check for updates and apply them promptly to ensure that your installation is secure and protected against known vulnerabilities.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software using just the composer.lock file, making it easy to stay informed about potential risks.
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
