PT-2024-5807 · Moodle+2 · Moodle+2

Published 2024-08-27 · Updated 2025-07-02 · CVE-2024-43425

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Moodle versions prior to 4.4.2 Moodle versions prior to 4.3.6 Moodle versions prior to 4.2.9 Moodle versions prior to 4.1.12

Description A flaw was found in Moodle, allowing remote code execution due to incomplete sanitization in the calculated question types feature. This requires the capability to add or update questions. Attackers can execute arbitrary code, potentially disclosing students' confidential information or disrupting the learning process. An estimated 238,205 exposed Moodle instances have been detected, and the issue has been exploited in the wild.

Recommendations For versions prior to 4.4.2, update to version 4.4.2 or later. For versions prior to 4.3.6, update to version 4.3.6 or later. For versions prior to 4.2.9, update to version 4.2.9 or later. For versions prior to 4.1.12, update to version 4.1.12 or later. As a temporary workaround, consider restricting access to the calculated questions feature until a patch is applied.

Exploit

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

ALT-PU-2024-16385

ALT-PU-2024-16417

BDU:2024-06552

BIT-MOODLE-2024-43425

CVE-2024-43425

GHSA-V6F4-V8H8-3C87

Affected Products

Alt Linux

Moodle

Red Os

References · 44

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/moodle_rce.rb · Exploit
• 🔥 https://github.com/RedTeamPentesting/moodle-rce-calculatedquestions · Exploit
• 🔥 https://exploit-db.com/exploits/52350 · Exploit
• https://osv.dev/vulnerability/GHSA-v6f4-v8h8-3c87 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-06552 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-43425 · Security Note
• https://osv.dev/vulnerability/BIT-moodle-2024-43425 · Vendor Advisory
• https://moodle.org/mod/forum/discuss.php?d=461193 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-43425 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-43425 · Security Note
• http://repo.red-soft.ru/redos/7.3c/x86_64/updates · Vendor Advisory
• https://safe-surf.ru/specialists/bulletins-nkcki/711146 · Security Note
• https://osv.dev/vulnerability/CVE-2024-43425 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-43425 · Vendor Advisory
• https://github.com/moodle/moodle · Note