Detections
Analytics
Moodle 4.2.x < 4.2.11 Multiple Vulnerabilities
medium Web App Scanning Plugin ID 114709
Language:
Synopsis
Moodle 4.2.x < 4.2.11 Multiple VulnerabilitiesDescription
According to its self-reported version, the Moodle install hosted on the remote host is 4.1.x prior to 4.1.14, 4.2.x prior to 4.2.11, 4.3.x prior to 4.3.8, or 4.4.x prior to 4.4.4. It is, therefore, affected by multiple vulnerabilities.- An IDOR when fetching report schedules.
- Some users can delete audiences of other reports.
- An IDOR in edit/delete RSS feed.
- Users' names returned in messaging error message.
Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.
Solution
Upgrade to Moodle version 4.2.11 or latest.See Also
http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-82386
http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-83180
http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-83181
http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-83352
https://moodle.org/mod/forum/discuss.php?d=462874#p1858332
https://moodle.org/mod/forum/discuss.php?d=462876#p1858334
Plugin Details
Severity: Medium
ID: 114709
Type: remote
Family: Component Vulnerability
Published: 4/10/2025
Updated: 4/10/2025
Scan Template: api, basic, full, pci, scan
Risk Information
VPR
Risk Factor: Low
Score: 1.4
CVSS v2
Risk Factor: Medium
Base Score: 4
Vector: CVSS2#AV:N/AC:L/Au:S/C:P/I:N/A:N
CVSS Score Source: CVE-2024-48896
CVSS v3
Risk Factor: Medium
Base Score: 4.3
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS Score Source: CVE-2024-48896
Vulnerability Information
CPE: cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*
Exploit Ease: No known exploits are available
Vulnerability Publication Date: 11/17/2024
Reference Information
CVE: CVE-2024-48896, CVE-2024-48897, CVE-2024-48898, CVE-2024-48901
OWASP: 2010-A6, 2010-A8, 2013-A5, 2013-A7, 2013-A9, 2017-A5, 2017-A6, 2017-A9, 2021-A1, 2021-A4, 2021-A6
WASC: Information Leakage, Insufficient Authorization
DISA STIG: APSC-DV-000460, APSC-DV-002570, APSC-DV-002630
HIPAA: 164.306(a)(1), 164.306(a)(2), 164.312(a)(1), 164.312(a)(2)(i)
ISO: 27001-A.13.1.1, 27001-A.14.1.2, 27001-A.14.1.3, 27001-A.14.2.5, 27001-A.18.1.3, 27001-A.6.2.2, 27001-A.9.1.2, 27001-A.9.4.1, 27001-A.9.4.4, 27001-A.9.4.5
NIST: sp800_53-AC-3, sp800_53-CM-6b, sp800_53-SI-11
OWASP API: 2019-API7, 2023-API8
OWASP ASVS: 4.0.2-14.2.1, 4.0.2-14.3.1