PT-2024-2476 · Moodle · Moodle

Fir3Storm · Published 2024-03-11 · Updated 2025-05-02 · CVE-2024-29374

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Moodle version 3.10.9

Description A Cross-Site Scripting (XSS) issue exists due to inadequate protection of the webpage structure when handling the lang parameter in the "/?lang=" URL parameter. This could allow a remote attacker to read, modify, or delete data and implement cross-site scripting attacks.

Recommendations For Moodle version 3.10.9, consider disabling the lang parameter in the "/?lang=" URL parameter until a patch is available. Restrict access to this parameter to minimize the risk of exploitation. Avoid using the lang parameter in the affected API endpoint until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-80

CWE-79

Related Identifiers

BDU:2024-02454

BIT-MOODLE-2024-29374

CVE-2024-29374

GHSA-3QW5-V9CC-V262

Affected Products

Moodle

References · 18

• 🔥 https://gist.github.com/fir3storm/f9c7f3ec1a6496498517ed216d2640b2 · Exploit
• https://ubuntu.com/security/CVE-2024-29374 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-3qw5-v9cc-v262 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-29374 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-02454 · Security Note
• https://cve.org/CVERecord?id=CVE-2024-29374 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-29374 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-29374 · Security Note
• https://osv.dev/vulnerability/BIT-moodle-2024-29374 · Vendor Advisory
• https://github.com/moodle/moodle · Note
• https://twitter.com/VulmonFeeds/status/1770912401535254800 · Twitter Post
• https://twitter.com/CVEnew/status/1770886250884444629 · Twitter Post
• https://t.me/cvenotify/90821 · Telegram Post
• https://security.snyk.io/vuln/SNYK-PHP-MOODLEMOODLE-6483244 · Note
• https://access.redhat.com/security/cve/CVE-2024-29374 · Note