CVE-2024-1439: Inadequate access control vulnerability in Moodle
First published: Mon Feb 12 2024(Updated: )
Inadequate access control in Moodle LMS. This vulnerability could allow a local user with a student role to create arbitrary events intended for users with higher roles. It could also allow the attacker to add events to the calendar of all users without their prior consent.
Credit: cve-coordination@incibe.es cve-coordination@incibe.es
| Affected Software | Affected Version | How to fix |
|---|---|---|
| composer/moodle/moodle | <=4.2.0 | |
| Moodle | <=4.2.11 |
Remedy
There is no reported solution at this time.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-1439?
CVE-2024-1439 has been classified with a moderate severity due to its potential for unauthorized event creation.
How do I fix CVE-2024-1439?
To fix CVE-2024-1439, update Moodle to version 4.2.1 or later, which addresses the inadequate access control issue.
Who is affected by CVE-2024-1439?
CVE-2024-1439 affects local users with a student role in Moodle versions up to and including 4.2.0.
What types of attacks can be executed using CVE-2024-1439?
An attacker can create arbitrary events intended for users with higher roles and add events to the calendars of all users.
Is a patch available for CVE-2024-1439?
Yes, a patch is available in the updated Moodle versions that resolve the vulnerabilities related to CVE-2024-1439.
- agent/title
- agent/weakness
- agent/remedy
- agent/first-publish-date
- agent/type
- agent/description
- collector/nvd-cve
- source/NVD
- agent/references
- agent/author
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-5p2x-8427-9fgp
- alias/CVE-2024-1439
- agent/software-canonical-lookup
- agent/event
- collector/github-advisory
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/severity
- agent/softwarecombine
- agent/trending
- agent/source
- agent/tags
- collector/nvd-api
- agent/software-canonical-lookup-request
- package-manager/composer
- vendor/moodle
- canonical/moodle
- version/moodle/4.2.11