CVE-2024-43428

What it actually does

Insufficient validation of data stored in local cache allows an attacker to inject crafted entries that are later served to other users without further checks.

Why it matters to the business

Users of the affected learning platform may receive incorrect or attacker-controlled content, eroding trust, disrupting course delivery, and requiring emergency maintenance; the issue affects a widely deployed open-source education system with no ransomware association and low exploitation probability.

How an attack unfolds

An attacker supplies specially formatted data through a local-storage interface that bypasses existing checks; the poisoned entry is persisted in cache and subsequently delivered to legitimate users who request the same resource.

How to fix it

Upgrade Moodle to the commit aea9770cfc7d003a737f4899489d1e3982efe9ac or later; for the listed Ubuntu 16.04 ffmpeg package apply version 7:2.8.3-1 or newer.

How to confirm the fix worked

Confirm the installed codebase contains commit aea9770cfc7d003a737f4899489d1e3982efe9ac; review cache-handling code paths for the added validation logic and re-run any existing cache-poisoning test cases.

Typical attack path

1. Locate a publicly reachable Moodle instance
2. Identify endpoints or parameters that accept local-storage data
3. Submit crafted input designed to survive cache insertion
4. Trigger cache population by accessing the affected resource
5. Observe or force other users to retrieve the poisoned cache entry

How to detect it

Inspect application and cache logs for unexpected entries or validation failures around local-storage operations; correlate with user activity that precedes cache population events.

What your security team should do

• Apply the listed fixed commit to all Moodle instances within the next maintenance window
• Add cache-entry integrity checks to monitoring dashboards
• Review logs for anomalous cache population events over the past 30 days
• Subscribe to Moodle security announcements to receive future validation-related updates promptly