Cloudanix VulnDB

CVE-2024-43431

High · 7.5

Moodle's IDOR in badges allows deletion of arbitrary badges

CVSS

7.5

EPSS

0.5%

Published

Nov 7, 2024

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A flaw in Moodle lets some users delete badges they should not be allowed to touch, which can erase important records of achievements.

Exploitation
Remote Authenticated
Attacker needs
Low Privilege
Complexity
Low
Impact
Data Tampering
Component
Application
Class
Authorization Bypass
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Insufficient capability checks allow authenticated users to delete badges they lack permission to access, bypassing intended authorization controls in the badge management functionality.

Why it matters to the business

Attackers can remove badges representing user achievements or credentials, leading to data loss, disrupted recognition systems, and potential compliance issues in educational platforms with high Moodle adoption.

How an attack unfolds

An attacker with a low-privileged account identifies badge deletion endpoints, crafts requests omitting proper capability verification, and successfully deletes badges belonging to other users or courses without triggering access denials.

How to fix it

Upgrade Moodle to the commit aea9770cfc7d003a737f4899489d1e3982efe9ac or apply the latest patched release that enforces proper capability checks on badge deletion operations.

How to confirm the fix worked

Verify the installed Moodle version includes commit aea9770cfc7d003a737f4899489d1e3982efe9ac, then test that users without the required capability receive access denied responses when attempting badge deletion.

Typical attack path

  1. Obtain a valid low-privileged Moodle account
  2. Discover badge-related API or web endpoints via enumeration
  3. Submit delete requests targeting badges outside the attacker's permitted scope
  4. Confirm deletion succeeds due to missing capability enforcement

How to detect it

Search Moodle web server and application logs for badge deletion requests originating from accounts lacking the moodle/badges:delete capability, including entries showing successful deletions without prior permission grants.

What your security team should do

  • Prioritize patching all Moodle instances to the fixed commit within the next maintenance window
  • Review and tighten badge-related capability assignments across roles
  • Enable detailed logging for badge management actions and monitor for anomalous deletions
  • Conduct a post-patch audit of existing badges for unauthorized removals

The record

A vulnerability was found in Moodle. Insufficient capability checks made it possible to delete badges that a user does not have permission to access.

Affected packages

Ecosystem Package Introduced Fixed
Packagist moodle/moodle 0 4.1.12
Packagist moodle/moodle 4.2.0-beta 4.2.9
Packagist moodle/moodle 4.3.0-beta 4.3.6
Packagist moodle/moodle 4.4.0-beta 4.4.2
Bitnami moodle 0 4.1.12
Ubuntu:16.04:LTS moodle 0 No fix
Ubuntu:18.04:LTS moodle 0 No fix
Ubuntu:Pro:16.04:LTS moodle 0 No fix
Ubuntu:Pro:18.04:LTS moodle 0 No fix
packagist moodle/moodle 4.2.0-beta 4.2.9
packagist moodle/moodle 4.3.0-beta 4.3.6
packagist moodle/moodle 4.4.0-beta 4.4.2

Related vulnerabilities