Cloudanix VulnDB

CVE-2024-43429

Medium · 5.3

Moodle has user information visibility control issues in gradebook reports

CVSS

5.3

EPSS

0.3%

Published

Nov 11, 2024

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A bug in the learning platform lets some users see private student details in reports that should have stayed hidden.

Exploitation
Remote Authenticated
Attacker needs
Low Privilege
Complexity
Low
Impact
Data Exposure
Component
Application
Class
Information Disclosure
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

The vulnerability exposes hidden user profile fields within gradebook reports, bypassing the intended access control enforced by the "view hidden user fields" capability.

Why it matters to the business

Organizations using the affected learning platform may inadvertently disclose sensitive user profile data to unauthorized staff or students, increasing privacy risks and potential compliance issues with data protection regulations.

How an attack unfolds

An attacker with access to gradebook reports but lacking the view hidden user fields permission simply navigates to or generates a gradebook report view, where the hidden fields are rendered and visible despite the missing capability.

How to fix it

Upgrade Moodle to the commit aea9770cfc7d003a737f4899489d1e3982efe9ac or apply the corresponding security patch; verify that gradebook report generation respects the hidden fields capability after deployment.

How to confirm the fix worked

After patching, create test users with hidden profile fields and roles lacking the view hidden user fields capability, then confirm those fields no longer appear in any gradebook report output.

Typical attack path

  1. Obtain a role or account with permission to view gradebook reports
  2. Navigate to or request a gradebook report for a course containing users with hidden profile fields
  3. Observe that hidden fields are included in the report output without requiring the view hidden user fields capability

How to detect it

Review web server and application logs for repeated gradebook report accesses by accounts without the view hidden user fields capability; inspect exported or viewed reports for presence of fields that should be hidden.

What your security team should do

  • Apply the fixed commit aea9770cfc7d003a737f4899489d1e3982efe9ac immediately due to the data exposure risk
  • Audit current gradebook report permissions and hidden field configurations across all courses
  • Monitor access logs for unusual report generation activity while planning the update

The record

A flaw was found in moodle. Some hidden user profile fields are visible in gradebook reports, which could result in users without the "view hidden user fields" capability having access to the information.

Affected packages

Ecosystem Package Introduced Fixed
Packagist moodle/moodle 0 4.1.12
Packagist moodle/moodle 4.2.0 4.2.9
Packagist moodle/moodle 4.3.0 4.3.6
Packagist moodle/moodle 4.4.0 4.4.2
Bitnami moodle 0 4.1.12
Ubuntu:16.04:LTS moodle 0 No fix
Ubuntu:18.04:LTS moodle 0 No fix
Ubuntu:Pro:16.04:LTS moodle 0 No fix
Ubuntu:Pro:18.04:LTS moodle 0 No fix
packagist moodle/moodle 4.2.0 4.2.9
packagist moodle/moodle 4.3.0 4.3.6
packagist moodle/moodle 4.4.0 4.4.2

Related vulnerabilities