CVE-2024-25983: Moodle - Insufficient checks in web service allow unauthorized comments on user's dashboard
Summary
CVE-2024-25983: Msa-24-0006: idor on dashboard comments block. Affects moodle across 3 version ranges.
< 4.1.9
>= 4.2.0, < 4.2.6
>= 4.3.0, < 4.3.3
Fixed in 4.1.9, 4.2.6 or 4.3.3, depending on the release line you run. How to fix ↓
Also tracked for
- moodle/moodle · Packagist
The same CVE-2024-25983 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning management system (LMS) used for creating and delivering online courses. It provides a platform for educators to create interactive and collaborative learning environments. Moodle is widely adopted by educational institutions and organizations worldwide.
Vulnerability Detail
The vulnerability identified as CVE-2024-25983 in Moodle allows for insufficient checks in a web service, enabling the addition of comments to the comments block on another user's dashboard when it is not otherwise available. This means that an attacker with access to the web service can post comments on a user's dashboard without proper authorization. The vulnerability poses a low risk as it does not directly impact the core functionality of Moodle, but it can potentially lead to unauthorized comments being displayed on a user's dashboard, compromising the integrity of the platform.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 4.1.94.1.9 -
>= 4.2.0, < 4.2.64.2.6 -
>= 4.3.0, < 4.3.34.3.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, users can mitigate the risk by ensuring that the affected web service is only accessible to authorized users and implementing proper access controls to prevent unauthorized access.
Conclusion
The vulnerability in Moodle allows unauthorized comments to be added to a user's dashboard through a web service. It is recommended to update Moodle to the latest versions and regularly apply updates to mitigate the risk. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for moodle →
FAQ
Moodle is an open-source learning management system used for creating and delivering online courses.
The vulnerability allows unauthorized comments to be added to a user's dashboard, potentially compromising the integrity of the platform.
To fix this vulnerability, update Moodle to the recommended versions (4.3.3, 4.2.6, or 4.1.9) and regularly apply updates to stay protected.
While no specific workaround is mentioned, implementing proper access controls and restricting access to the affected web service can help mitigate the risk.
For more information about this vulnerability, refer to the provided source link: https://github.com/bitnami/vulndb/tree/main/data/moodle/BIT-moodle-2024-25983.json
Related vulnerabilities
Recent vulnerabilities recorded for moodle.
