CVE-2024-48896: Moodle User Name Leakage via Messaging Error
Summary
CVE-2024-48896: Moodle leaks user names. Affects moodle/moodle across 4 version ranges.
< 4.1.14
>= 4.2.0, < 4.2.11
>= 4.3.0, < 4.3.8
>= 4.4.0, < 4.4.4
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- moodle · Bitnami
The same CVE-2024-48896 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is a widely used open-source learning platform designed to provide educators, administrators, and learners with a single robust, secure, and integrated system to create personalized learning environments. It offers a variety of features including course management, user management, and messaging capabilities. However, a vulnerability has been identified that allows users with the 'send message' capability to inadvertently access the names of other users, which could lead to privacy concerns.
Vulnerability Detail
The vulnerability arises from improper handling of error messages in the Messaging feature of Moodle. When users attempt to send messages to other users they do not have access to, the system returns an error message that includes the full names of those users. This leakage of information can lead to unauthorized knowledge of user identities, potentially facilitating targeted attacks or harassment. The vulnerability is classified under CWE-209, which pertains to information exposure through an error message.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 4.1.144.1.14composer require moodle/moodle:4.1.14 -
>= 4.2.0, < 4.2.114.2.11composer require moodle/moodle:4.2.11 -
>= 4.3.0, < 4.3.84.3.8composer require moodle/moodle:4.3.8 -
>= 4.4.0, < 4.4.44.4.4composer require moodle/moodle:4.4.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, administrators can restrict the 'send message' capability for users who should not have access to other users' names. This can be configured in the user permissions settings within the Moodle administration panel.
Conclusion
In summary, CVE-2024-48896 is a significant vulnerability in Moodle that exposes user names through error messages in the messaging system. It is crucial for users to update their installations to the latest patched versions to mitigate this risk. Additionally, implementing temporary workarounds can help protect user privacy until the update is applied.
See every vulnerability recorded for moodle/moodle →
FAQ
CVE-2024-48896 is a vulnerability in Moodle that allows users with messaging capabilities to view the names of other users through error messages.
Any Moodle installation that allows users to send messages may be affected, particularly if the user permissions are not properly configured.
The primary risk is the exposure of user identities, which could lead to privacy violations and targeted harassment.
You can use Vulert's playground to check if your application is affected by this vulnerability without requiring any installation or signup.
The CVSS score of this vulnerability is 4.3, indicating a moderate severity level.
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
