PT-2024-8616 · Moodle+2 · Moodle+2

Taiyou · Published 2024-08-19 · Updated 2025-08-06 · CVE-2024-43436

Positive Technologies (AI Summary)

CVSS v2.0

8.3

High

Base vector

AV:N/AC:L/Au:M/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Moodle versions (affected versions not specified)

Description A SQL injection risk flaw was found in the XMLDB editor tool available to site administrators. This issue is related to the lack of protection against SQL query structure exploitation, which may allow a remote attacker to execute arbitrary SQL queries in the database.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

ALT-PU-2024-16385

ALT-PU-2024-16417

BDU:2024-10190

BIT-MOODLE-2024-43436

CVE-2024-43436

GHSA-MX26-62XM-2P83

Affected Products

Alt Linux

Moodle

Red Os

References · 18

• https://osv.dev/vulnerability/CVE-2024-43436 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-10190 · Security Note
• https://ubuntu.com/security/CVE-2024-43436 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-43436 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-moodle-2024-43436 · Vendor Advisory
• https://moodle.org/mod/forum/discuss.php?d=461206 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-mx26-62xm-2p83 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-43436 · Security Note
• https://cve.org/CVERecord?id=CVE-2024-43436 · Security Note
• https://github.com/moodle/moodle · Note
• https://t.me/cvedetector/10088 · Telegram Post
• https://redos.red-soft.ru/support/secure · Note
• https://t.me/cveNotify/130971 · Telegram Post
• https://bugzilla.redhat.com/show_bug.cgi?id=2304264 · Note
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/mnozhestvennye-uyazvimosti-moodle-2111242 · Note