CVE-2024-43438: Moodle's IDOR in Feedback non-respondents report allows messaging arbitrary site users
A flaw was found in Feedback. Bulk messaging in the activity's non-respondents report did not verify message recipients belonging to the set of users returned by the report.
Other sources
Moodle's IDOR in Feedback non-respondents report allows messaging arbitrary site users
— Packagist
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 4.4.2 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 4.3.6 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 4.2.9 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 4.1.12
Event History
Frequently Asked Questions
What is the severity of CVE-2024-43438?
CVE-2024-43438 has been classified with a high severity level due to the potential for unauthorized bulk messaging.
How do I fix CVE-2024-43438?
To fix CVE-2024-43438, upgrade to Moodle version 4.4.2, 4.3.6, 4.2.9, or 4.1.12.
Which Moodle versions are affected by CVE-2024-43438?
CVE-2024-43438 affects Moodle versions between 4.1.0 to 4.1.12, 4.2.0 to 4.2.9, 4.3.0 to 4.3.6, and 4.4.0-beta to 4.4.2.
What type of issue is CVE-2024-43438?
CVE-2024-43438 is a security flaw related to insufficient verification of message recipients in the bulk messaging feature.
Who is impacted by CVE-2024-43438?
Users of Moodle versions 4.1.x, 4.2.x, 4.3.x, and 4.4.x are at risk due to this vulnerability.