This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.

[TLP:CLEAR] Moodle fixes 4 vulnerabilities

Moodle fixes 4 vulnerabilities with versions 4.4.1, 4.3.5, 4.2.8 and 4.1.11 [1][2][3][4].

Moodle - XSS (CVE-2024-38274)
CVSS 6.1 (Medium)

An authenticated remote attacker can carry out an XSS attack by inserting a specially crafted event into the calendar [1].

The vulnerability is present in product:

  • Moodle; >=4.1, <4.1.11; >=4.2, <4.2.8; >=4.3, <4.3.5; >=4.4, <4.4.1;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

More information:

The vulnerability was publicly disclosed 19. 6. 2024.

Moodle - HTTP header leak (CVE-2024-38275)
CVSS 7.5 (High)

An unauthenticated remote attacker can gain unauthorized access to authorization information from HTTP headers when requests are forwarded [2].

The vulnerability is present in product:

  • Moodle; >=4.1, <4.1.11; >=4.2, <4.2.8; >=4.3, <4.3.5; >=4.4, <4.4.1;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

More information:

The vulnerability was publicly disclosed 19. 6. 2024.

Moodle - CSRF (CVE-2024-38276)
CVSS 8.8 (High)

An authenticated remote attacker is allowed to carry out a CSRF attack in multiple places [3].

The vulnerability is present in product:

  • Moodle; >=4.1, <4.1.11; >=4.2, <4.2.8; >=4.3, <4.3.5; >=4.4, <4.4.1;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 19. 6. 2024.

Moodle - unauthorized access (CVE-2024-38273)
CVSS 5.4 (Medium)

An authenticated remote attacker is allowed to bypass access control to BigBlueButton online conferences [4].

The vulnerability is present in product:

  • Moodle; >=4.1, <4.1.11; >=4.2, <4.2.8; >=4.3, <4.3.5; >=4.4, <4.4.1;

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L

More information:

The vulnerability was publicly disclosed 19. 6. 2024.

By CESNET, z.s.p.o. Martin Krajči on 26. 6. 2024.

CESNET, z.s.p.o. Logo