CVE-2024-43435: Moodle Insufficient Capability Checks Vulnerability
Summary
CVE-2024-43435: Moodle has insufficient capability checks. Affects moodle/moodle across 4 version ranges.
< 4.1.12
>= 4.2.0, < 4.2.9
>= 4.3.0, < 4.3.6
>= 4.4.0, < 4.4.2
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- moodle · Bitnami
The same CVE-2024-43435 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is a widely-used open-source learning platform designed to provide educators, administrators, and learners with a single robust, secure, and integrated system to create personalized learning environments. It offers features such as course management, user management, and various plugins to enhance educational experiences. However, a recent vulnerability has been identified that affects its capability checks, potentially allowing unauthorized access to sensitive functionalities.
Vulnerability Detail
A flaw was found in Moodle due to insufficient capability checks. This vulnerability allows users who have access to restore glossaries in courses to exploit this permission and restore them into the global site glossary. This could lead to unauthorized modifications or access to glossary content, impacting the integrity and confidentiality of the educational material.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 4.1.124.1.12composer require moodle/moodle:4.1.12 -
>= 4.2.0, < 4.2.94.2.9composer require moodle/moodle:4.2.9 -
>= 4.3.0, < 4.3.64.3.6composer require moodle/moodle:4.3.6 -
>= 4.4.0, < 4.4.24.4.2composer require moodle/moodle:4.4.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the available patches as soon as possible.
Conclusion
The insufficient capability checks vulnerability in Moodle (CVE-2024-43435) poses a risk to the integrity of glossary content within the platform. It is essential for users to update their installations to the latest patched versions to safeguard against potential exploitation. Regular monitoring and updates are vital for maintaining the security of open-source software.
See every vulnerability recorded for moodle/moodle →
FAQ
CVE-2024-43435 is a vulnerability in Moodle that arises from insufficient capability checks, allowing unauthorized users to restore glossaries into the global site glossary.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The affected versions include Moodle 4.4.0 to 4.4.1, 4.3.0 to 4.3.5, 4.2.0 to 4.2.8, and all versions up to 4.1.12.
The CVSS score of this vulnerability is 5.3, indicating a low severity level.
While there are no specific workarounds, it is crucial to prioritize updating your installation to mitigate the risk associated with this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
