CVE-2024-43435: Moodle has insufficient capability checks
5.3
CVSS Score
3.1
Basic Information
CVE ID
GHSA ID
EPSS Score
0.40545%
CWE
Published
11/11/2024
Updated
11/12/2024
KEV Status
No
Technology
PHP
PHPTechnical Details
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| moodle/moodle | composer | >= 4.4.0, < 4.4.2 | 4.4.2 |
| moodle/moodle | composer | >= 4.3.0, < 4.3.6 | 4.3.6 |
| moodle/moodle | composer | >= 4.2.0, < 4.2.9 | 4.2.9 |
| moodle/moodle | composer | < 4.1.12 | 4.1.12 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The vulnerability stems from missing capability checks during glossary restoration. The commit MDL-64984 specifically addresses adding a capability check in mod_glossary's restore logic. The restore_glossary_activity_task::execute function is responsible for restoration setup, and prior to the fix, it didn't validate if the user had global glossary management permissions. This matches the CVE description of insufficient checks allowing unauthorized global glossary restorations. The file path and function are derived from standard Moodle module structure and the commit's context.