PT-2024-25636 · Moodle+2 · Moodle+2

Paul Holden · Published 2024-05-31 · Updated 2024-07-19 · CVE-2024-34008

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Moodle (affected versions not specified)

Description The issue concerns a CSRF risk in the admin management of analytics models due to the lack of a necessary token. This could allow unauthorized actions on behalf of users.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

ALT-PU-2024-8851

ALT-PU-2024-9067

BIT-MOODLE-2024-34008

CVE-2024-34008

GHSA-68X5-4JG5-GJGG

Affected Products

Alt Linux

Moodle

Red Os

References · 16

• https://osv.dev/vulnerability/CVE-2024-34008 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-34008 · Security Note
• https://ubuntu.com/security/CVE-2024-34008 · Vendor Advisory
• https://moodle.org/mod/forum/discuss.php?d=458397 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-moodle-2024-34008 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-34008 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-34008 · Security Note
• https://osv.dev/vulnerability/GHSA-68x5-4jg5-gjgg · Vendor Advisory
• https://github.com/moodle/moodle · Note
• https://github.com/moodle/moodle/commit/498a766263743ee649f6874e440a94517a077e2e · Note
• https://t.me/cvenotify/81788 · Telegram Post
• http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-81059 · Note
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/mnozhestvennye-uyazvimosti-moodle-01-07-24 · Note
• https://twitter.com/oktsec/status/1811417569376514396 · Twitter Post
• https://t.me/cvenotify/81670 · Telegram Post