CVE-2024-45690: Moodle OAuth2 Linked Account Deletion IDOR Vulnerability
Summary
CVE-2024-45690: Moodle IDOR when deleting OAuth2 linked accounts. Affects moodle/moodle across 4 version ranges.
< 4.1.13
>= 4.2.0-beta, < 4.2.10
>= 4.3.0-beta, < 4.3.7
>= 4.4.0-beta, < 4.4.3
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- moodle · Bitnami
The same CVE-2024-45690 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is a widely-used open-source learning platform designed to provide educators, administrators, and learners with a single robust, secure, and integrated system to create personalized learning environments. It supports various features such as course management, user enrollment, and assessment tools. However, a recent vulnerability has been identified that affects the deletion of OAuth2-linked accounts, potentially allowing unauthorized users to delete accounts they do not own.
Vulnerability Detail
The vulnerability arises from an Insecure Direct Object Reference (IDOR) flaw in Moodle's handling of OAuth2-linked account deletions. This issue allows users to delete accounts linked to OAuth2 without proper authorization checks, which can lead to unauthorized account deletions. The lack of additional verification mechanisms means that users may inadvertently or maliciously remove accounts that do not belong to them, resulting in data loss and disruption of services for affected users.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 4.1.134.1.13composer require moodle/moodle:4.1.13 -
>= 4.2.0-beta, < 4.2.104.2.10composer require moodle/moodle:4.2.10 -
>= 4.3.0-beta, < 4.3.74.3.7composer require moodle/moodle:4.3.7 -
>= 4.4.0-beta, < 4.4.34.4.3composer require moodle/moodle:4.4.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, administrators can restrict user permissions related to account management until the patch is applied. This can be done by reviewing and adjusting user roles and capabilities within the Moodle settings.
Conclusion
In summary, CVE-2024-45690 is a significant vulnerability in Moodle that allows unauthorized deletion of OAuth2-linked accounts. It is crucial for users to update their installations to the latest patched versions to mitigate this risk. Additionally, utilizing tools like Vulert can help monitor for such vulnerabilities in the future.
See every vulnerability recorded for moodle/moodle →
FAQ
CVE-2024-45690 is a vulnerability in Moodle that allows users to delete OAuth2-linked accounts without proper authorization checks.
If you are using Moodle versions prior to the patched versions (4.1.13, 4.2.10, 4.3.7, or 4.4.3), your installation is vulnerable.
The primary risk is unauthorized deletion of user accounts, which can lead to data loss and disruption of services for users.
You can apply the patch by updating your Moodle installation to the latest version using Composer. Run composer update moodle/moodle in your project directory.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in your software by analyzing the composer.lock file. You can check if your application is affected by this vulnerability using the Vulert playground at Vulert Scanner.
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
