CVE-2021-43559: Moodle - CSRF Risk in 'delete related badge' Functionality
Summary
CVE-2021-43559: A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions. Affects moodle across 4 version ranges.
< 3.8.9
>= 3.9.0, < 3.9.11
>= 3.10.0, < 3.10.8
>= 3.11.0, < 3.11.4
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- moodle/moodle · Packagist
The same CVE-2021-43559 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning management system (LMS) used for creating and delivering online courses. It provides a wide range of features for educators and learners, including course management, content creation, and assessment tools. Moodle is widely adopted by educational institutions and organizations around the world. However, versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10, and earlier unsupported versions of Moodle are vulnerable to a CSRF (Cross-Site Request Forgery) risk in the 'delete related badge' functionality.
Vulnerability Detail
The 'delete related badge' functionality in Moodle did not include the necessary token check to prevent CSRF attacks. This vulnerability allows an attacker to trick an authenticated user into performing unwanted actions on their behalf. By enticing a user to visit a malicious website or click on a specially crafted link, an attacker can exploit this vulnerability to delete badges associated with the user's account. This can lead to the loss of earned badges and potential disruption to the user's learning progress.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 3.8.93.8.9 -
>= 3.9.0, < 3.9.113.9.11 -
>= 3.10.0, < 3.10.83.10.8 -
>= 3.11.0, < 3.11.43.11.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users can disable the 'delete related badge' functionality in Moodle until the system is updated to a patched version. This can be done by modifying the Moodle code or configuration to remove or disable the option for users to delete badges. However, this workaround should only be considered as a temporary measure and not a long-term solution.
Conclusion
In conclusion, Moodle versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10, and earlier unsupported versions are vulnerable to a CSRF risk in the 'delete related badge' functionality. Users should upgrade to the latest patched versions and review their custom code/plugins to ensure they are not affected. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for moodle →
FAQ
Moodle is an open-source learning management system used for creating and delivering online courses.
Versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10, and earlier unsupported versions of Moodle are affected.
CSRF (Cross-Site Request Forgery) is a type of attack that tricks an authenticated user into performing unwanted actions on their behalf.
This vulnerability allows an attacker to delete badges associated with a user's account, leading to the loss of earned badges and potential disruption to the user's learning progress.
To mitigate this vulnerability, it is recommended to upgrade to the latest patched versions of Moodle (3.8.8, 3.9.11, 3.10.8, or 3.11.4) and review/update any custom code or plugins that may be affected.
Related vulnerabilities
Recent vulnerabilities recorded for moodle.
