Moodle: idor in badges allows deletion of arbitrary badges

Vulnerability

Description CVE-2024-43431 is a vulnerability in Moodle that stems from insufficient capability checks. The flaw allows a user to delete badges even when they lack the necessary permissions to access those badges. This indicates a missing or improperly enforced authorization check in the badge management functionality [1][2].

Exploitation

To exploit this vulnerability, an attacker must be an authenticated user of the Moodle site. The attack does not require any special privileges beyond a standard user account. The attacker can delete badges that are not intended for their role, potentially affecting badges owned or managed by other users or system-wide badges [1][2].

Impact

Successful exploitation allows an attacker to delete badges that they should not have access to. This can disrupt the badge system, remove earned credentials from other users, and undermine the integrity of the site's recognition and achievement framework. The impact is primarily on data integrity and availability of badge records [1][2].

Mitigation

The Moodle project has addressed this vulnerability in a security release. Administrators are advised to update their Moodle installations to the latest patched version. No workaround is currently available other than applying the update [1][2].