CVE-2024-45689: Moodle allows users to retrieve information they did not have permission to access
6.5
CVSS Score
3.1
Basic Information
CVE ID
GHSA ID
EPSS Score
0.21162%
CWE
Published
11/20/2024
Updated
11/20/2024
KEV Status
No
Technology
PHP
PHPTechnical Details
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| moodle/moodle | composer | < 4.1.13 | 4.1.13 |
| moodle/moodle | composer | >= 4.2.0-beta, < 4.2.10 | 4.2.10 |
| moodle/moodle | composer | >= 4.3.0-beta, < 4.3.7 | 4.3.7 |
| moodle/moodle | composer | >= 4.4.0-beta, < 4.4.3 | 4.4.3 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The vulnerability stemmed from missing capability checks in dynamic table handlers. The key modification in the patch was adding a has_capability() call in lib/table/classes/external/dynamic/get.php's execute method. This indicates the execute method previously processed requests without proper authorization validation. The interface change (adding has_capability() requirement) and exception addition in this endpoint confirm this was the missing security control. Other modified files implement the new capability method but weren't themselves vulnerable - the root issue was in the request handling flow controlled by get.php's execute method.