A flaw was found in moodle. Matrix room membership and power levels are incorrectly applied and revoked for suspended Moodle users.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A flaw was found in moodle. Matrix room membership and power levels are incorrectly applied and revoked     for suspended Moodle users. (CVE-2024-43433)

Note that Nessus relies on the presence of the package as reported by the vendor.

According to its self-reported version, the Moodle install hosted on the remote host is 4.4.x prior to 4.4.2. It is, therefore, affected by multiples vulnerabilities :

- Matrix user/power level management not always working as expected with suspended users.

- Lack of access control when using external methods for Quiz overrides.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - A flaw was found in moodle. Matrix room membership and power levels are incorrectly applied and revoked
    for suspended Moodle users. (CVE-2024-43433)

ID	Name	Product	Family	Type	Severity
261482	Linux Distros Unpatched Vulnerability : CVE-2024-43433	Nessus	Misc.	Local	medium
114720	Moodle 4.4.x < 4.4.2 Multiples Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	medium
418013	SCA: security update for moodle/moodle (GHSA-q99x-mjmh-v8w7)	Tenable Cloud Security	SCA Checks	Local	medium
418013	SCA: security update for moodle/moodle (GHSA-q99x-mjmh-v8w7)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium

Detections

Analytics

CVE-2024-43433

medium

Tenable Plugins

medium

medium

medium

medium