CVE-2024-33999: falha crítica em Moodle
moodle: unsafe direct use of $_SERVER['HTTP_REFERER'] in admin/tool/mfa/index.php
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
28Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 9.8epss 0.5%
The referrer URL used by MFA required additional sanitizing, rather than being used directly.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
MoodleCVEs relacionadas — Moodle
No mesmo produto, das mais perigosas para as menos.
CVE-2024-34000MEDIUMmoodle: stored XSS in lesson overview report via user ID numberEPSS 0.5%CVE-2024-34005MEDIUMmoodle: authenticated LFI risk in some misconfigured shared hosting environments via modified mod_data backupEPSS 0.5%CVE-2024-34002MEDIUMmoodle: authenticated LFI risk in some misconfigured shared hosting environments via modified mod_feedback backupEPSS 0.5%CVE-2024-34004MEDIUMmoodle: authenticated LFI risk in some misconfigured shared hosting environments via modified mod_wiki backupEPSS 0.5%CVE-2024-34009HIGHmoodle: ReCAPTCHA can be bypassed on the login pageEPSS 0.4%CVE-2024-34001HIGHmoodle: CSRF risk in admin preset tool management of presetsEPSS 0.4%