CVE-2024-38276: CSRF Vulnerability in Moodle
Summary
CVE-2024-38276: moodle: CSRF risks due to misuse of confirm_sesskey. Affects moodle across 4 version ranges.
< 4.1.10
>= 4.2.0, < 4.2.8
>= 4.3.0, < 4.3.5
>= 4.4.0, < 4.4.1
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- moodle/moodle · Packagist
The same CVE-2024-38276 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning management system (LMS) used by educational institutions to create and deliver online courses. It provides a wide range of features for course management, content creation, and student engagement. Moodle is widely adopted and used by millions of users worldwide. However, a CSRF vulnerability has been identified in Moodle, which can lead to multiple CSRF risks.
Vulnerability Detail
The CSRF vulnerability in Moodle arises from incorrect CSRF token checks. This can allow an attacker to perform unauthorized actions on behalf of an authenticated user. By exploiting this vulnerability, an attacker can potentially perform actions such as changing user settings, modifying course content, or even gaining administrative access. The impact of this vulnerability can be severe, compromising the integrity and confidentiality of the Moodle instance.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 4.1.104.1.10 -
>= 4.2.0, < 4.2.84.2.8 -
>= 4.3.0, < 4.3.54.3.5 -
>= 4.4.0, < 4.4.14.4.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, as a general security practice, it is recommended to implement strong CSRF protection mechanisms, such as using anti-CSRF tokens and validating the referer header, to mitigate CSRF attacks.
Conclusion
The CSRF vulnerability in Moodle, identified as CVE-2024-38276, poses a significant risk to the security and integrity of Moodle instances. It is crucial for Moodle administrators to update their installations to the recommended versions or later to mitigate this vulnerability. Implementing strong CSRF protection measures is also advised to enhance the overall security posture of the Moodle platform.
See every vulnerability recorded for moodle →
FAQ
Moodle is an open-source learning management system (LMS) used for creating and delivering online courses.
A CSRF (Cross-Site Request Forgery) vulnerability allows an attacker to perform unauthorized actions on behalf of an authenticated user.
The CSRF vulnerability in Moodle can lead to unauthorized actions, such as changing user settings, modifying course content, or gaining administrative access.
To fix the CSRF vulnerability, it is recommended to update Moodle to version 4.4.0 or later.
While no specific workaround is mentioned, implementing strong CSRF protection mechanisms can help mitigate CSRF attacks.
Related vulnerabilities
Recent vulnerabilities recorded for moodle.
