CVE-2024-48899: Moodle IDOR Vulnerability in Course Badges Access
Summary
CVE-2024-48899: Moodle IDOR when accessing list of course badges. Affects moodle/moodle versions >= 4.4.0-beta, < 4.4.3. Fixed in 4.4.3. How to fix ↓
Also tracked for
- moodle · Bitnami
The same CVE-2024-48899 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is a widely-used open-source learning platform designed to provide educators, administrators, and learners with a single robust, secure, and integrated system to create personalized learning environments. It supports various educational activities and resources, making it a popular choice for institutions worldwide. However, like any software, it is susceptible to vulnerabilities that can compromise user data and system integrity. The identified vulnerability allows unauthorized access to course badges, which can lead to information disclosure and potential misuse.
Vulnerability Detail
The vulnerability arises from an Insecure Direct Object Reference (IDOR) issue when users attempt to access the list of course badges. Insufficient checks are in place to ensure that users can only retrieve badges for courses they are authorized to view. This flaw can lead to unauthorized users gaining access to sensitive information related to course achievements, potentially impacting user privacy and data security.
How To Fix
Minimum fixed version
4.4.3
This is the first release that contains the fix.
composer require moodle/moodle:4.4.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, restrict user access to course badges by implementing additional access controls within your Moodle settings until the package can be updated. This can involve reviewing user roles and permissions to ensure that only authorized users can access specific course information.
Conclusion
The Moodle IDOR vulnerability (CVE-2024-48899) poses a risk by allowing unauthorized access to course badges. It is crucial for users to update to the patched version (4.4.3 or later) to mitigate this risk. Implementing additional access controls can serve as a temporary measure until the update is applied.
See every vulnerability recorded for moodle/moodle →
FAQ
CVE-2024-48899 is a vulnerability in Moodle that allows unauthorized users to access course badges due to insufficient access controls.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Course badges in Moodle are digital awards that recognize a learner's achievements in a course, which can be displayed on their profile.
If you cannot update Moodle right away, implement stricter access controls to limit who can view course badges as a temporary workaround.
The vulnerability is classified as moderate, but it can lead to unauthorized access to sensitive information, so it should be addressed promptly.
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
