Moodle up to 4.1.14/4.3.8/4.4.4/4.5.0 Separate Groups Mode access control

Summaryinfo

A vulnerability has been found in Moodle up to 4.1.14/4.3.8/4.4.4/4.5.0 and classified as critical. The affected element is an unknown function of the component Separate Groups Mode. The manipulation leads to access control. This vulnerability is uniquely identified as CVE-2024-55646. The attack is possible to be carried out remotely. No exploit exists. The affected component should be upgraded.

Detailsinfo

A vulnerability, which was classified as critical, has been found in Moodle up to 4.1.14/4.3.8/4.4.4/4.5.0. This issue affects an unknown part of the component Separate Groups Mode. The manipulation with an unknown input leads to a access control vulnerability. Using CWE to declare the problem leads to CWE-284. The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. Impacted is confidentiality.

It is possible to read the advisory at bugzilla.redhat.com. The identification of this vulnerability is CVE-2024-55646 since 12/10/2024. The exploitation is known to be easy. The attack may be initiated remotely. The technical details are unknown and an exploit is not publicly available. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 12/17/2024). The attack technique deployed by this issue is T1068 according to MITRE ATT&CK.

Upgrading to version 4.1.15, 4.3.9, 4.4.5 or 4.5.1 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Learning Management Software

Name

• Moodle

Version

• 4.0
• 4.1
• 4.1.0
• 4.1.1
• 4.1.2
• 4.1.3
• 4.1.4
• 4.1.5
• 4.1.6
• 4.1.7
• 4.1.8
• 4.1.9
• 4.1.10
• 4.1.11
• 4.1.12
• 4.1.13
• 4.1.14
• 4.2
• 4.3
• 4.3.0
• 4.3.1
• 4.3.2
• 4.3.3
• 4.3.4
• 4.3.5
• 4.3.6
• 4.3.7
• 4.3.8
• 4.4
• 4.4.0
• 4.4.1
• 4.4.2
• 4.4.3
• 4.4.4
• 4.5.0

License

• open-source

Website

• Product: https://moodle.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion