CVE-2024-43428: Moodle: cache poisoning via injection into storage
Published Nov 7, 2024
·Updated
To address a cache poisoning risk in Moodle, additional validation for local storage was required.
Affected Software
8 affected componentsFixes available
composer/moodle/moodle>=4.4.0-beta<4.4.2
4.4.2
composer/moodle/moodle>=4.3.0-beta<4.3.6
4.3.6
composer/moodle/moodle>=4.2.0-beta<4.2.9
4.2.9
composer/moodle/moodle<4.1.12
4.1.12
Moodle moodle<4.1.12
Moodle moodle>=4.2.0<4.2.9
Moodle moodle>=4.3.0<4.3.6
Moodle moodle>=4.4.0<4.4.2
Event History
Nov 7, 2024
CVE Published
via MITRE·01:24 PM
Data Sourced
via MITRE·01:24 PM
DescriptionSeverity
Data Sourced
via NVD·02:15 PM
DescriptionSeverity
Data Sourced
via NVD·02:15 PM
WeaknessAffected Software
Advisory Published
via GitHub·03:31 PM
Frequently Asked Questions
1
What is the severity of CVE-2024-43428?
CVE-2024-43428 is considered a medium severity vulnerability due to its cache poisoning risk.
2
How do I fix CVE-2024-43428?
To fix CVE-2024-43428, you should upgrade Moodle to version 4.4.2, 4.3.6, 4.2.9, or 4.1.12.
3
Who is affected by CVE-2024-43428?
CVE-2024-43428 affects users running Moodle versions between 4.4.0-beta and 4.4.2, 4.3.0-beta and 4.3.6, 4.2.0-beta and 4.2.9, or up to 4.1.12.
4
What does CVE-2024-43428 affect?
CVE-2024-43428 affects local storage validation in Moodle, posing a cache poisoning risk.
5
When was CVE-2024-43428 disclosed?
CVE-2024-43428 was disclosed in 2024, highlighting the importance of timely software updates.