Detections
Analytics
Moodle 4.4.x < 4.4.5 Multiple Vulnerabilities
high Web App Scanning Plugin ID 114721
Language:
Synopsis
Moodle 4.4.x < 4.4.5 Multiple VulnerabilitiesDescription
According to its self-reported version, the Moodle install hosted on the remote host is 4.1.x prior to 4.1.15, 4.3.x prior to 4.3.9, or 4.4.x prior to 4.4.5. It is, therefore, affected by multiple vulnerabilities.- A potential denial of service risk due to guest sessions' longer timeout period.
- A database activity issue in separate groups mode, for users not in a group.
- An email change confirmation token available via preference.
- A tag index page displays other users tagged with the selected tag.
- Unprotected access to sensitive information via learning plan web service.
Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.
Solution
Upgrade to Moodle version 4.4.5 or latest.See Also
http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-61316
http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-82379
http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-82757
http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-82963
http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-83921
https://moodle.org/mod/forum/discuss.php?d=464554#p1864992
https://moodle.org/mod/forum/discuss.php?d=464555#p1864993
https://moodle.org/mod/forum/discuss.php?d=464556#p1864994
Plugin Details
Severity: High
ID: 114721
Type: remote
Family: Component Vulnerability
Published: 4/10/2025
Updated: 4/10/2025
Scan Template: api, basic, full, pci, scan
Risk Information
VPR
Risk Factor: Medium
Score: 4.2
CVSS v2
Risk Factor: Medium
Base Score: 6.4
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N
CVSS Score Source: CVE-2024-55644
CVSS v3
Risk Factor: High
Base Score: 7.5
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS Score Source: CVE-2024-55643
Vulnerability Information
CPE: cpe:2.3:a:fedoraproject:fedora:*:*:*:*:*:*:*:*
Exploit Ease: No known exploits are available
Vulnerability Publication Date: 12/16/2024
Reference Information
CVE: CVE-2024-55643, CVE-2024-55644, CVE-2024-55645, CVE-2024-55646, CVE-2024-55648
OWASP: 2010-A6, 2013-A5, 2013-A9, 2017-A6, 2017-A9, 2021-A1, 2021-A6
WASC: Denial of Service, Information Leakage
CAPEC: 116, 13, 147, 169, 197, 22, 224, 285, 287, 290, 291, 292, 293, 294, 295, 296, 297, 298, 299, 300, 301, 302, 303, 304, 305, 306, 307, 308, 309, 310, 312, 313, 317, 318, 319, 320, 321, 322, 323, 324, 325, 326, 327, 328, 329, 330, 472, 492, 497, 508, 573, 574, 575, 576, 577, 59, 60, 616, 643, 646, 651, 79
DISA STIG: APSC-DV-000460, APSC-DV-002400, APSC-DV-002630
HIPAA: 164.306(a)(1), 164.306(a)(2)
ISO: 27001-A.12.6.1, 27001-A.14.2.5
NIST: sp800_53-CM-6b, sp800_53-SC-5, sp800_53-SI-15
OWASP API: 2019-API7, 2023-API8
OWASP ASVS: 4.0.2-14.2.1, 4.0.2-8.3.4