CVE-2024-34006: moodle: unsanitized HTML in site log for config_log_created
Published May 31, 2024
·Updated
The site log report required additional encoding of event descriptions to ensure any HTML in the content is displayed in plaintext instead of being rendered.
Affected Software
6 affected componentsFixes available
composer/moodle/moodle<4.1.10
4.1.10
composer/moodle/moodle>=4.2.0<4.2.7
4.2.7
composer/moodle/moodle>=4.3.0<4.3.4
4.3.4
Moodle moodle<4.1.10
Moodle moodle>=4.2.0<4.2.7
Moodle moodle>=4.3.0<4.3.4
Event History
May 31, 2024
CVE Published
via MITRE·08:36 PM
Data Sourced
via MITRE·08:36 PM
DescriptionWeakness
Data Sourced
via NVD·09:15 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·09:15 PM
Affected Software
Advisory Published
via GitHub·09:30 PM
Frequently Asked Questions
1
What is the severity of CVE-2024-34006?
CVE-2024-34006 has a moderate severity rating due to the potential for cross-site scripting (XSS).
2
How do I fix CVE-2024-34006?
To fix CVE-2024-34006, upgrade to Moodle version 4.1.10, 4.2.7, or 4.3.4 as appropriate.
3
What software is affected by CVE-2024-34006?
CVE-2024-34006 affects Moodle versions prior to 4.1.10, 4.2.7, and 4.3.4.
4
What type of vulnerability is CVE-2024-34006?
CVE-2024-34006 is a cross-site scripting (XSS) vulnerability that can allow malicious content to be executed.
5
What are the risks associated with CVE-2024-34006?
The risks associated with CVE-2024-34006 include potential data breach and unauthorized actions taken by attackers through XSS.