CVE-2024-43425highCWE-94

CVE-2024-43425: high-severity vulnerability in moodle

Moodle: remote code execution via calculated question types

Published

Follow this CVE+ Monitor moodle+ Monitor moodle/moodle

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

78Vexday Risk Score

Patch soon. It has a working public exploit.

ssvc Attendcvss 8.1epss 88%
from disclosure to weaponsame day
Published on NVDNov 7
1st PoCAug 23
metasploitAug 27
What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Red HatVEX document ↗
Not affected
1 product — because the vulnerable code is not present in the product
red_hat_products
A flaw was found in Moodle. Additional restrictions are required to avoid a remote code execution risk in calculated question types. Note: This requires the capability to add/update questions.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
moodle
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — moodle

In the same product, most dangerous first.

CVE-2026-26046HIGHMoodle: moodle: improper input sanitization in tex filter administration settingEPSS 13.8%CVE-2023-30943MEDIUMMoodle: tinymce loaders susceptible to arbitrary folder creationEPSS 6.8%CVE-2023-5540MEDIUMMoodle: authenticated remote code execution risk in imscpEPSS 2.3%CVE-2023-5539MEDIUMMoodle: authenticated remote code execution risk in lessonEPSS 2.2%CVE-2023-5550MEDIUMMoodle: rce due to lfi risk in some misconfigured shared hosting environmentsEPSS 1.6%CVE-2023-5546MEDIUMMoodle: stored xss in quiz grading report via user id numberEPSS 1.3%