CVE-2024-43435

What it actually does

Insufficient capability checks allow a user with course-level glossary restore rights to restore a glossary directly into the global site glossary.

Why it matters to the business

Attackers can pollute or manipulate the shared site glossary used by all courses, leading to incorrect or malicious content appearing across the learning platform and requiring manual cleanup.

How an attack unfolds

An attacker obtains or is granted the ability to restore glossaries inside a course, then uses the restore workflow to target the global site glossary instead of a course-level one, bypassing the intended authorization boundary.

How to fix it

Upgrade Moodle to the commit aea9770cfc7d003a737f4899489d1e3982efe9ac or later; verify the restored glossary capability checks are enforced before allowing course restores.

How to confirm the fix worked

After upgrade, attempt to restore a glossary backup from a course context and confirm that only course-level glossaries are offered as restore targets and that global site glossary selection is denied.

Typical attack path

1. Obtain or receive course-level glossary restore capability
2. Prepare a glossary backup file containing desired entries
3. Initiate restore of the backup while selecting the global site glossary as the target destination
4. Confirm successful restore of entries into the site-wide glossary

How to detect it

Search Moodle restore logs and event logs for glossary restore operations where the target context is the site glossary (contextlevel 10) initiated by users whose primary role is course-level.

What your security team should do

• Apply the fixed commit aea9770cfc7d003a737f4899489d1e3982efe9ac immediately on all Moodle instances
• Audit existing course roles and remove glossary restore capability from any roles that do not require it
• Review recent glossary restore activity in the Moodle logs for entries restored to the site glossary