CVE-2024-45689: Moodle Dynamic Tables Information Disclosure Vulnerability
Summary
CVE-2024-45689: Moodle allows users to retrieve information they did not have permission to access. Affects moodle/moodle across 4 version ranges.
< 4.1.13
>= 4.2.0-beta, < 4.2.10
>= 4.3.0-beta, < 4.3.7
>= 4.4.0-beta, < 4.4.3
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- moodle · Bitnami
The same CVE-2024-45689 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Moodle is an open-source learning platform designed to provide educators, administrators, and learners with a single robust, secure, and integrated system to create personalized learning environments. It offers a wide range of features including course management, user management, and various plugins to enhance functionality. However, a recent vulnerability has been identified that allows unauthorized users to access sensitive information through dynamic tables without proper capability checks.
Vulnerability Detail
A flaw was found in Moodle's implementation of dynamic tables, which failed to enforce necessary capability checks. This oversight allows users to retrieve information they should not have access to, potentially exposing sensitive data. The vulnerability is classified under CWE-285, which pertains to improper authorization. If exploited, this could lead to unauthorized information disclosure, affecting user privacy and data integrity.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 4.1.134.1.13composer require moodle/moodle:4.1.13 -
>= 4.2.0-beta, < 4.2.104.2.10composer require moodle/moodle:4.2.10 -
>= 4.3.0-beta, < 4.3.74.3.7composer require moodle/moodle:4.3.7 -
>= 4.4.0-beta, < 4.4.34.4.3composer require moodle/moodle:4.4.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, administrators can restrict access to dynamic tables by adjusting user permissions and capabilities until the update can be applied. This can be done through the Moodle admin interface by reviewing and modifying roles and permissions associated with user access.
Conclusion
The vulnerability CVE-2024-45689 in Moodle poses a significant risk by allowing unauthorized access to sensitive information through dynamic tables. It is crucial for users to update to the latest patched versions to mitigate this risk and ensure the security of their Moodle installations.
See every vulnerability recorded for moodle/moodle →
FAQ
CVE-2024-45689 is a vulnerability in Moodle that allows unauthorized users to access information they should not have access to due to improper capability checks in dynamic tables.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to analyze your composer.lock file without any signup.
The primary risk is unauthorized access to sensitive information, which can compromise user privacy and data integrity within the Moodle platform.
You can update your Moodle installation using Composer. Run the command: composer require moodle/moodle:^4.1.13 or the appropriate version for your installation to apply the necessary patches.
Yes, you can temporarily restrict access to dynamic tables by adjusting user permissions and capabilities through the Moodle admin interface.
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
