CVE-2024-45690: Moodle OAuth2 Account Deletion IDOR Vulnerability
Summary
CVE-2024-45690: Moodle: idor when deleting oauth2 linked accounts. Affects moodle across 4 version ranges.
< 4.1.13
>= 4.2.0, < 4.2.10
>= 4.3.0, < 4.3.7
>= 4.4.0, < 4.4.3
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- moodle/moodle · Packagist
The same CVE-2024-45690 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning platform designed to provide educators, administrators, and learners with a single robust, secure, and integrated system to create personalized learning environments. It supports various functionalities, including course management, user management, and integration with external services via OAuth2. However, a flaw has been identified that allows users to delete OAuth2-linked accounts without proper authorization checks.
Vulnerability Detail
The vulnerability arises from insufficient validation checks when users attempt to delete their OAuth2-linked accounts. This IDOR (Insecure Direct Object Reference) flaw allows unauthorized users to delete accounts that do not belong to them, potentially leading to data loss and unauthorized access to sensitive information. The issue affects multiple versions of Moodle, making it critical for users to address it promptly.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 4.1.134.1.13 -
>= 4.2.0, < 4.2.104.2.10 -
>= 4.3.0, < 4.3.74.3.7 -
>= 4.4.0, < 4.4.34.4.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, administrators can restrict user permissions related to account deletion until the patch is applied. This can be done by modifying user roles and capabilities in the Moodle administration settings.
Conclusion
In summary, CVE-2024-45690 is a significant vulnerability in Moodle that allows unauthorized deletion of OAuth2-linked accounts. It is crucial for users to update their installations to the patched versions to mitigate risks associated with this flaw. Additionally, using tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for moodle →
FAQ
CVE-2024-45690 is a vulnerability in Moodle that allows unauthorized deletion of OAuth2-linked accounts due to insufficient validation checks.
If you are using Moodle versions prior to 4.1.13, 4.2.10, 4.3.7, or 4.4.3, your installation is likely affected by this vulnerability.
The risks include unauthorized account deletions, potential data loss, and exposure of sensitive information.
You can update your Moodle installation by downloading the latest version from the official Moodle website and following the upgrade instructions provided.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using just a manifest file like package-lock.json. You can also check if your application is affected by this vulnerability using the Vulert playground without any signup.
Related vulnerabilities
Recent vulnerabilities recorded for moodle.
