CVE-2024-43431: Moodle Badge Deletion Vulnerability Due to Insufficient Capability Checks
Summary
CVE-2024-43431: Moodle: idor in badges allows deletion of arbitrary badges. Affects moodle across 4 version ranges.
< 4.1.12
>= 4.2.0, < 4.2.9
>= 4.3.0, < 4.3.6
>= 4.4.0, < 4.4.2
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- moodle/moodle · Packagist
The same CVE-2024-43431 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning platform designed to provide educators, administrators, and learners with a single robust, secure, and integrated system to create personalized learning environments. It supports a variety of features including course management, user management, and a range of plugins to enhance functionality. However, a recent vulnerability has been identified that allows unauthorized deletion of badges, which are essential for recognizing user achievements within the platform.
Vulnerability Detail
A vulnerability was discovered in Moodle that stems from insufficient capability checks. This flaw allows users to delete badges that they do not have permission to access, potentially leading to unauthorized modifications of user achievements and undermining the integrity of the platform. The vulnerability affects multiple versions of Moodle, making it crucial for users to address this issue promptly to maintain security and trust in the system.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 4.1.124.1.12 -
>= 4.2.0, < 4.2.94.2.9 -
>= 4.3.0, < 4.3.64.3.6 -
>= 4.4.0, < 4.4.24.4.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, restrict user permissions related to badge management until the update can be applied. Review user roles and capabilities to ensure that only authorized users can manage badges.
Conclusion
The vulnerability CVE-2024-43431 poses a significant risk to Moodle installations by allowing unauthorized deletion of badges. It is essential for users to update their systems to the latest patched versions to mitigate this risk. Additionally, implementing temporary workarounds can help protect against potential exploitation until updates are applied.
See every vulnerability recorded for moodle →
FAQ
CVE-2024-43431 is a vulnerability in Moodle that allows unauthorized deletion of badges due to insufficient capability checks.
If you are using Moodle versions prior to 4.1.12, 4.2.9, 4.3.6, or 4.4.2, your installation is vulnerable. You can check your version in the admin settings.
The main risk is that unauthorized users can delete badges, which can compromise the integrity of user achievements and the overall trust in the Moodle platform.
Yes, you can use Vulert to monitor your application for vulnerabilities in real-time. It requires only a manifest file like package-lock.json to function.
Vulert provides a service to monitor open-source vulnerabilities without requiring code access. You can check your application for vulnerabilities using the Vulert playground at Vulert Scanner.
Related vulnerabilities
Recent vulnerabilities recorded for moodle.
