CVE-2024-45690
📋 TL;DR
This vulnerability in Moodle allows users to delete OAuth2-linked accounts without proper authorization checks. It affects Moodle instances with OAuth2 authentication enabled, potentially allowing users to delete accounts they shouldn't have access to.
💻 Affected Systems
- Moodle
📦 What is this software?
Moodle by Moodle
Moodle by Moodle
Moodle by Moodle
Moodle by Moodle
⚠️ Risk & Real-World Impact
Worst Case
Malicious users could delete legitimate user accounts, causing data loss and service disruption for affected users.
Likely Case
Users accidentally or intentionally deleting accounts they shouldn't have access to, leading to account recovery issues.
If Mitigated
Minimal impact with proper access controls and monitoring in place.
🎯 Exploit Status
Requires authenticated user access but minimal technical skill needed
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check Moodle security advisory for specific patched versions
Vendor Advisory: https://moodle.org/security/
Restart Required: No
Instructions:
1. Check Moodle security advisory for patched version. 2. Update Moodle to patched version. 3. Verify OAuth2 account deletion functionality works correctly.
🔧 Temporary Workarounds
Disable OAuth2 account deletion
allTemporarily disable the ability for users to delete OAuth2-linked accounts
Modify Moodle configuration to restrict account deletion permissions
🧯 If You Can't Patch
- Implement strict access controls on account deletion functionality
- Enable detailed logging and monitoring of all account deletion attempts
🔍 How to Verify
Check if Vulnerable:
Test if users can delete OAuth2-linked accounts they shouldn't have access toCheck Version:
Check Moodle version in administration panel or via moodle_version tableVerify Fix Applied:
Verify that proper authorization checks are in place for OAuth2 account deletion📡 Detection & Monitoring
Log Indicators:
- Unexpected account deletion events
- Multiple failed deletion attempts
- Deletion of OAuth2-linked accounts
Network Indicators:
- Unusual patterns of account management requests
SIEM Query:
Search for account deletion events involving OAuth2 users outside normal patterns