A vulnerability was found in Moodle. Additional checks are required to ensure users with permission to view badge recipients can only access lists of those they are intended to have access to.

According to its self-reported version, the Moodle install hosted on the remote host is 4.4.x prior to 4.4.4. It is, therefore, affected by multiple insecure direct object reference.

- An IDOR when accessing list of badge recipients.

- An IDOR when accessing list of course badges.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - A vulnerability was found in Moodle. Additional checks are required to ensure users with permission to
    view badge recipients can only access lists of those they are intended to have access to. (CVE-2024-48900)

ID	Name	Product	Family	Severity
114711	Moodle 4.4.x < 4.4.4 Multiple Insecure Direct Object Reference	Web App Scanning	Component Vulnerability	medium
414999	SCA: security update for moodle/moodle (GHSA-g8r3-2v89-j6r5)	Tenable Cloud Security	SCA Checks	medium
414999	SCA: security update for moodle/moodle (GHSA-g8r3-2v89-j6r5)	Tenable Self-Hosted Container Security	SCA Checks	medium

Detections

Analytics

CVE-2024-48900

medium

Tenable Plugins

medium

medium

medium