CVE-2024-45689

What it actually does

Dynamic tables in Moodle bypassed capability checks, allowing users to retrieve information without the required permissions.

Why it matters to the business

Unauthorized users can access sensitive organizational or user data, increasing risk of privacy violations and compliance failures. The issue affects widely deployed Moodle instances with low but persistent exploit probability.

How an attack unfolds

An attacker with basic authenticated access crafts requests to dynamic table endpoints that omit or ignore capability enforcement, directly retrieving rows or records they are not authorized to view.

How to fix it

Upgrade moodle/moodle (GIT) to commit d4f5e92ee156002b95db1ab6f76e25870563e2f6. For libarchive on Ubuntu 14.04 LTS update to 3.1.2-7ubuntu2.3; for Ubuntu 16.04 LTS update to 3.1.2-11ubuntu0.16.04.2.

How to confirm the fix worked

After upgrade, confirm that dynamic table code paths now perform explicit capability checks before returning data and test with low-privilege accounts to verify restricted information is no longer accessible.

Typical attack path

1. Obtain low-privileged authenticated session in Moodle
2. Locate dynamic table rendering endpoints or AJAX handlers
3. Submit requests that bypass or omit capability checks
4. Extract sensitive data returned in responses

How to detect it

Search Moodle web and database logs for dynamic table requests returning data volumes or record types inconsistent with the caller's documented capabilities.

What your security team should do

• Apply the listed fixed versions immediately on all Moodle instances
• Review Moodle access and audit logs for anomalous dynamic table queries
• Temporarily restrict dynamic table features to trusted roles if patching is delayed