CVE-2024-43428: Moodle Cache Poisoning Risk Mitigation
Summary
CVE-2024-43428: Moodle: cache poisoning via injection into storage. Affects moodle across 4 version ranges.
< 4.1.12
>= 4.2.0, < 4.2.9
>= 4.3.0, < 4.3.6
>= 4.4.0, < 4.4.2
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- moodle/moodle · Packagist
The same CVE-2024-43428 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning platform designed to provide educators, administrators, and learners with a single robust, secure, and integrated system to create personalized learning environments. It is widely used in educational institutions for course management and online learning. However, like many web applications, Moodle can be susceptible to security vulnerabilities, including cache poisoning risks that can compromise the integrity of stored data.
Vulnerability Detail
The vulnerability identified as CVE-2024-43428 pertains to a cache poisoning risk within Moodle. This issue arises from insufficient validation for local storage, which could allow an attacker to manipulate cached data, potentially leading to unauthorized access or data corruption. The ramifications of this vulnerability are significant, as it could compromise the integrity of user data and the overall functionality of the Moodle platform, affecting both administrators and learners.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 4.1.124.1.12 -
>= 4.2.0, < 4.2.94.2.9 -
>= 4.3.0, < 4.3.64.3.6 -
>= 4.4.0, < 4.4.24.4.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary measure, users can implement additional validation checks in their local storage handling to mitigate the risk of cache poisoning until they can apply the official patch. This may involve reviewing and sanitizing data before it is stored in the cache.
Conclusion
In summary, CVE-2024-43428 presents a significant cache poisoning risk for Moodle users. It is crucial to update to the patched versions to ensure the integrity and security of the platform. Additionally, users can implement temporary workarounds while preparing for the update.
See every vulnerability recorded for moodle →
FAQ
CVE-2024-43428 is a vulnerability in Moodle that poses a cache poisoning risk due to insufficient validation for local storage.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which allows you to monitor for open-source vulnerabilities without requiring installation.
The consequences include potential unauthorized access to cached data and data corruption, which can disrupt the functionality of the Moodle platform.
The patched versions of Moodle are 4.1.12, 4.2.9, 4.3.6, and 4.4.2.
You can update your Moodle installation by downloading the latest patched version, replacing the existing files, and running the upgrade script through the admin interface.
Related vulnerabilities
Recent vulnerabilities recorded for moodle.
