CVE-2024-34000: moodle: stored XSS in lesson overview report via user ID number
Published May 31, 2024
·Updated
ID numbers displayed in the lesson overview report required additional sanitizing to prevent a stored XSS risk.
Affected Software
6 affected componentsFixes available
composer/moodle/moodle<4.1.10
4.1.10
composer/moodle/moodle>=4.2.0<4.2.7
4.2.7
composer/moodle/moodle>=4.3.0<4.3.4
4.3.4
Moodle moodle<4.1.10
Moodle moodle>=4.2.0<4.2.7
Moodle moodle>=4.3.0<4.3.4
Event History
Apr 12, 2024
News Published
via BleepingComputer·01:28 PM
News Published
via BleepingComputer·01:29 PM
Apr 15, 2024
News Published
via BleepingComputer·12:59 PM
Apr 16, 2024
News Published
via BleepingComputer·06:36 PM
Apr 19, 2024
News Published
via BleepingComputer·03:27 PM
May 31, 2024
CVE Published
via MITRE·08:01 PM
Data Sourced
via MITRE·08:01 PM
DescriptionWeakness
Data Sourced
via NVD·08:15 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·08:15 PM
Affected Software
Advisory Published
via GitHub·09:30 PM
Frequently Asked Questions
1
What is the severity of CVE-2024-34000?
CVE-2024-34000 is classified as a moderate severity vulnerability due to its potential for stored XSS exploitation.
2
How do I fix CVE-2024-34000?
To mitigate CVE-2024-34000, upgrade to Moodle versions 4.1.10, 4.2.7, or 4.3.4 or later.
3
What types of applications are vulnerable to CVE-2024-34000?
CVE-2024-34000 affects the Moodle learning management system, specifically versions prior to the patches mentioned.
4
What does CVE-2024-34000 affect in Moodle?
CVE-2024-34000 affects the lesson overview report where ID numbers are not properly sanitized.
5
Is CVE-2024-34000 exploitable remotely?
Yes, CVE-2024-34000 can be exploited remotely to execute stored XSS attacks.