CVE-2024-25983: Authorization Bypass in Moodle
Summary
CVE-2024-25983: Authorization Bypass in moodle. Affects moodle/moodle across 3 version ranges.
< 4.1.9
>= 4.2.0, < 4.2.6
>= 4.3.0, < 4.3.3
Fixed in 4.1.9, 4.2.6 or 4.3.3, depending on the release line you run. How to fix ↓
Also tracked for
- moodle · Bitnami
The same CVE-2024-25983 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning management system (LMS) used by educational institutions to create and deliver online courses. It provides a platform for educators to manage course content, interact with students, and track their progress. Moodle is widely adopted and offers various features such as discussion forums, quizzes, and assignment submissions. However, a vulnerability has been discovered in Moodle that allows unauthorized users to add comments to the comments block on another user's dashboard, even when it is not available on their profile page.
Vulnerability Detail
The vulnerability arises from insufficient checks in a web service, which enables an attacker to bypass authorization and add comments to the comments block on another user's dashboard. This can lead to unauthorized access to personal information and potential misuse of the platform. The vulnerability has a CVSS score of 3.5, indicating a moderate severity level.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 4.1.94.1.9composer require moodle/moodle:4.1.9 -
>= 4.2.0, < 4.2.64.2.6composer require moodle/moodle:4.2.6 -
>= 4.3.0, < 4.3.34.3.3composer require moodle/moodle:4.3.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users can disable the comments block on their dashboard until the Moodle update is applied. This can be done by accessing the dashboard settings and removing the comments block from the displayed elements.
Conclusion
In conclusion, Moodle is affected by an authorization bypass vulnerability that allows unauthorized comments on another user's dashboard. It is crucial to update Moodle to the recommended versions or apply the provided workaround to mitigate the risk of unauthorized access and potential misuse of personal information. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for moodle/moodle →
FAQ
Moodle is an open-source learning management system used by educational institutions for online course management.
The vulnerability allows unauthorized users to add comments to the comments block on another user's dashboard, potentially leading to unauthorized access and misuse of personal information.
To fix this vulnerability, update Moodle to the recommended versions mentioned in the 'how_to_fix' section.
Yes, users can temporarily disable the comments block on their dashboard until the Moodle update is applied. Instructions for this workaround are provided in the 'workaround' section.
The vulnerability has a CVSS score of 3.5, indicating a moderate severity level.
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
