CVE-2024-43430

What it actually does

The flaw permits external API requests to the Quiz module to bypass contained access controls, allowing unauthorized operations on quiz resources.

Why it matters to the business

Educational platforms may experience unauthorized viewing or modification of quiz content and results, risking assessment integrity and potential exposure of learner data across installations.

How an attack unfolds

An attacker identifies a reachable external API endpoint for Quiz and submits specially formed requests that override the insufficient authorization checks to access or alter restricted quiz data without valid permissions.

How to fix it

Upgrade flashplugin-nonfree on Ubuntu 14.04 LTS to version 11.2.202.548ubuntu0.14.04.1; apply equivalent patches or configuration hardening for the Quiz external API access controls in affected Moodle deployments.

How to confirm the fix worked

Confirm the package version matches the fixed release, then test that external API calls to Quiz now enforce proper authorization and cannot override access restrictions.

Typical attack path

1. Locate exposed Moodle instances with Quiz API enabled
2. Send unauthenticated or low-privileged API calls targeting Quiz functions
3. Leverage the bypass to retrieve or manipulate quiz questions, attempts, or grades

How to detect it

Review web server and application logs for unusual external API requests to Quiz endpoints that succeed without expected authentication tokens or role checks.

What your security team should do

• Apply the listed fixed version or equivalent API access control updates without delay
• Audit external API usage logs for Quiz module activity
• Temporarily restrict or disable external Quiz API access if upgrade cannot be performed immediately