CVE-2024-43430: Moodle Quiz API Insufficient Access Control Vulnerability
Summary
CVE-2024-43430: Moodle: lack of access control when using external methods for quiz overrides. Affects moodle versions >= 4.4.0, < 4.4.2. Fixed in 4.4.2. How to fix ↓
Also tracked for
- moodle/moodle · Packagist
The same CVE-2024-43430 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is a widely-used open-source learning platform designed to provide educators, administrators, and learners with a single robust, secure, and integrated system to create personalized learning environments. It offers various features, including course management, user management, and assessment tools. However, a recent vulnerability has been identified that affects the external API access to the Quiz module, allowing unauthorized access due to insufficient access control.
Vulnerability Detail
A flaw was found in Moodle that allows external API access to the Quiz module to override contained insufficient access control. This vulnerability can lead to unauthorized users gaining access to quiz data and potentially modifying or retrieving sensitive information. The issue arises from improper validation of user permissions when accessing the Quiz API, which could have serious implications for data security and user privacy.
How To Fix
Minimum fixed version
4.4.2
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can restrict access to the Quiz API by implementing additional authentication checks or by disabling external API access until the patch is applied. This can be done by modifying the relevant configuration settings in your Moodle instance.
Conclusion
The CVE-2024-43430 vulnerability in Moodle highlights the importance of proper access control in API functionalities. By updating to the patched version or implementing workarounds, users can protect their systems from potential unauthorized access and data breaches.
See every vulnerability recorded for moodle →
FAQ
CVE-2024-43430 is a vulnerability in Moodle that allows unauthorized access to the Quiz module via external API due to insufficient access control.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The risks include unauthorized access to quiz data, potential modification of sensitive information, and breaches of user privacy.
Yes, a patch is available in Moodle version 4.4.2 and later. It is recommended to update to this version to mitigate the vulnerability.
If you cannot update immediately, consider implementing additional authentication checks or disabling external API access as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for moodle.
