CVE-2024-25981: Msa-24-0004: forum export did not respect activity group settings
MSA-24-0004: Forum export did not respect activity group settings
Description: Separate Groups mode restrictions were not honoured when performing a forum export, which would export forum data for all groups. By default this only provided additional access to non-editing teachers. Issue summary: Forum export did not respect activity group settings Severity/Risk: Minor Versions affected: 4.3 to 4.3.2, 4.2 to 4.2.5, 4.1 to 4.1.8 and earlier unsupported versions Versions fixed: 4.3.3, 4.2.6 and 4.1.9 Reported by: Leon Stringer Issue no.: MDL-80504 CVE identifier: Pending Changes (master): http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-80504
Other sources
Separate Groups mode restrictions were not honored when performing a forum export, which would export forum data for all groups. By default this only provided additional access to non-editing teachers.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/moodleto a version that resolves this vulnerability.Fixed in 4.3.3 - Upgrade
Upgrade
redhat/4.2.6 andto a version that resolves this vulnerability.Fixed in 4.1.9 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 4.1.9 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 4.2.6 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 4.3.3 - Upgrade
Upgrade
moodleto a version that resolves this vulnerability.Fixed in 4.3.3 - Upgrade
Upgrade
moodleto a version that resolves this vulnerability.Fixed in 4.2.6 - Upgrade
Upgrade
moodleto a version that resolves this vulnerability.Fixed in 4.1.9 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch MSA-24-0004
Event History
Frequently Asked Questions
What is the severity of CVE-2024-25981?
CVE-2024-25981 has been categorized as a medium severity vulnerability.
How do I fix CVE-2024-25981?
To resolve CVE-2024-25981, update to Moodle versions 4.1.9, 4.2.6, or 4.3.3.
Who is affected by CVE-2024-25981?
CVE-2024-25981 affects installations of Moodle versions prior to 4.1.9, 4.2.6, and 4.3.3.
What does CVE-2024-25981 exploit?
CVE-2024-25981 exploits a weakness in the forum export feature which does not honor group restrictions.
What are the symptoms of CVE-2024-25981?
The symptoms of CVE-2024-25981 include unauthorized access to forum export data for users not intended to see that information.