CVE-2024-43435: Moodle: can create global glossary without being admin
Published Nov 11, 2024
·Updated
A flaw was found in moodle. Insufficient capability checks make it possible for users with access to restore glossaries in courses to restore them into the global site glossary.
Affected Software
8 affected componentsFixes available
composer/moodle/moodle<4.1.12
4.1.12
composer/moodle/moodle>=4.2.0<4.2.9
4.2.9
composer/moodle/moodle>=4.3.0<4.3.6
4.3.6
composer/moodle/moodle>=4.4.0<4.4.2
4.4.2
Moodle moodle<4.1.12
Moodle moodle>=4.2.0<4.2.9
Moodle moodle>=4.3.0<4.3.6
Moodle moodle>=4.4.0<4.4.2
Event History
Nov 11, 2024
CVE Published
via MITRE·12:17 PM
Data Sourced
via MITRE·12:17 PM
DescriptionSeverity
Data Sourced
via NVD·01:15 PM
DescriptionSeverityWeakness
Advisory Published
via GitHub·03:31 PM
Frequently Asked Questions
1
What is the severity of CVE-2024-43435?
CVE-2024-43435 is considered a high-severity vulnerability due to insufficient capability checks in Moodle.
2
How do I fix CVE-2024-43435?
To fix CVE-2024-43435, upgrade Moodle to version 4.1.12, 4.2.9, 4.3.6, or 4.4.2 or later.
3
What causes CVE-2024-43435?
CVE-2024-43435 is caused by insufficient capability checks that allow unauthorized users to restore glossaries in Moodle.
4
Who is affected by CVE-2024-43435?
Users with access to restore glossaries in courses are potentially affected by CVE-2024-43435.
5
What impact does CVE-2024-43435 have on Moodle?
CVE-2024-43435 can allow unauthorized changes to the global site glossary, potentially leading to data integrity issues.