CVE-2024-34000: falha de média gravidade em Moodle
moodle: stored XSS in lesson overview report via user ID number
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 4.3epss 0.5%
ID numbers displayed in the lesson overview report required additional sanitizing to prevent a stored XSS risk.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Produtos afetados
MoodleCVEs relacionadas — Moodle
No mesmo produto, das mais perigosas para as menos.
CVE-2024-33999CRITICALmoodle: unsafe direct use of $_SERVER['HTTP_REFERER'] in admin/tool/mfa/index.phpEPSS 0.5%CVE-2024-34005MEDIUMmoodle: authenticated LFI risk in some misconfigured shared hosting environments via modified mod_data backupEPSS 0.5%CVE-2024-34002MEDIUMmoodle: authenticated LFI risk in some misconfigured shared hosting environments via modified mod_feedback backupEPSS 0.5%CVE-2024-34004MEDIUMmoodle: authenticated LFI risk in some misconfigured shared hosting environments via modified mod_wiki backupEPSS 0.5%CVE-2024-34009HIGHmoodle: ReCAPTCHA can be bypassed on the login pageEPSS 0.4%CVE-2024-34001HIGHmoodle: CSRF risk in admin preset tool management of presetsEPSS 0.4%