CVE-2024-43434: Moodle has CSRF risk in Feedback non-respondents report
8.1
CVSS Score
3.1
Basic Information
CVE ID
GHSA ID
EPSS Score
0.35793%
CWE
Published
11/7/2024
Updated
11/7/2024
KEV Status
No
Technology
PHP
PHPTechnical Details
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| moodle/moodle | composer | < 4.1.12 | 4.1.12 |
| moodle/moodle | composer | >= 4.2.0-beta, < 4.2.9 | 4.2.9 |
| moodle/moodle | composer | >= 4.3.0-beta, < 4.3.6 | 4.3.6 |
| moodle/moodle | composer | >= 4.4.0-beta, < 4.4.2 | 4.4.2 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The vulnerability centers on the Feedback module's non-respondents report bulk messaging feature. Moodle's standard CSRF protection requires validating tokens via require_sesskey() or form tokens. The advisory explicitly states the check was incorrect in this flow. The most logical location for this vulnerability is in the bulk action processor for non-respondents, which would handle message sending. While exact code isn't provided, Moodle's module structure and security patterns strongly suggest the processor class responsible for bulk actions in the non-respondents report is where the missing/invalid token check occurred.