CVE-2024-33996

What it actually does

The vulnerability stems from insufficient validation of event types in the calendar web service, permitting users to specify event audiences beyond their authorized permissions.

Why it matters to the business

This could result in unauthorized publication of events, potentially exposing sensitive information or disrupting normal operations within the learning platform.

How an attack unfolds

An attacker with limited permissions sends crafted requests to the calendar web service endpoint, bypassing the event type checks to create events with restricted audiences.

How to fix it

Update to the fixed commit e8d03fdae4ec30a40cdc535c8e9e95f30604ec10 in the moodle/moodle repository.

How to confirm the fix worked

Verify the codebase contains the commit hash e8d03fdae4ec30a40cdc535c8e9e95f30604ec10 and test that users cannot create unauthorized event types.

Typical attack path

1. Identify calendar web service endpoint
2. Craft malicious event creation request with unauthorized type
3. Submit request to create event
4. Verify event publication

How to detect it

Examine web server logs for unusual calendar event creation requests and audit event type fields for anomalies.

What your security team should do

• Apply the security patch immediately
• Review calendar event permissions
• Monitor for unusual event creations