Cloudanix VulnDB

CVE-2024-48899

None

Moodle IDOR when accessing list of course badges

CVSS

—

EPSS

0.3%

Published

Nov 20, 2024

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

Users could see badge information from courses they were not supposed to access, potentially revealing details about classes or achievements meant to stay private.

Exploitation
Remote Authenticated
Attacker needs
Low Privilege
Complexity
Low
Impact
Data Exposure
Component
Application
Class
Authorization Bypass
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

The vulnerability permits an authorization bypass in Moodle, allowing authenticated users to retrieve lists of course badges for courses they lack access to due to missing access control checks on badge listing endpoints.

Why it matters to the business

Attackers or unauthorized insiders can view sensitive course badge information, potentially exposing details about course participation, achievements, or internal structures that should remain restricted, leading to privacy leaks and compliance risks without requiring elevated privileges.

How an attack unfolds

An attacker with a valid Moodle account sends crafted requests to the badge listing functionality, bypassing intended course access restrictions to enumerate badges across unauthorized courses.

How to fix it

Upgrade Moodle to the fixed commit d7e3bea9fa95ff686b370969cc1bcc3fca0919bf or apply the latest patched release that enforces proper access controls on course badge retrieval.

How to confirm the fix worked

After patching, confirm that requests for badge lists on unauthorized courses return access denied responses; review code changes around badge access checks and test with multiple user roles.

Typical attack path

  1. Obtain a valid user account in the Moodle instance
  2. Identify the badge listing API or web endpoint handling course badges
  3. Craft and send requests specifying target course identifiers without proper enrollment or access
  4. Receive unauthorized badge lists due to absent server-side authorization checks

How to detect it

Examine web server and Moodle access logs for repeated or anomalous requests to badge listing endpoints from users without corresponding course enrollment records; look for patterns of cross-course badge enumeration.

What your security team should do

  • Apply the Moodle patch immediately given the authorization nature of the flaw
  • Audit logs for unusual badge list queries from non-enrolled users
  • Review and tighten course access policies as a defense-in-depth measure
  • Monitor for similar authorization issues in other Moodle plugins or features

The record

A vulnerability was found in Moodle. Additional checks are required to ensure users can only fetch the list of course badges for courses that they are intended to have access to.

Affected packages

Ecosystem Package Introduced Fixed
Packagist moodle/moodle 4.4.0-beta 4.4.3
Bitnami moodle 4.4.0 4.4.4
Ubuntu:16.04:LTS moodle 0 No fix
Ubuntu:18.04:LTS moodle 0 No fix
Ubuntu:Pro:16.04:LTS moodle 0 No fix
Ubuntu:Pro:18.04:LTS moodle 0 No fix
packagist moodle/moodle 4.4.0-beta 4.4.3

Related vulnerabilities