CVE-2024-33996

MediumCVSS 6.2/10Last modified Jun 17, 2026

Description

Incorrect validation of allowed event types in a calendar web service made it possible for some users to create events with types/audiences they did not have permission to publish to.

Metrics

CVSS 3.1 6.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:H/A:N

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
Moodle	Moodle	>= 4.0, <= 4.3.3; >= 4.2, <= 4.2.6; >= 4.1, <= 4.1.9
moodle	moodle	>= 4.0.0, <= 4.3.3
moodle	moodle	>= 4.1.0, <= 4.1.9
moodle	moodle	>= 4.2.0, <= 4.2.6

References

https://moodle.org/mod/forum/discuss.php?d=458384#p1840909Vendor Advisory
https://moodle.org/mod/forum/discuss.php?d=458384#p1840909Vendor Advisory

Timeline

Published: May 31, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-339976.1Additional sanitizing was required when opening the equation editor to prevent a stored XSS risk when editing another user's equation.CVE-2024-339985.4Insufficient escaping of participants' names in the participants page table resulted in a stored XSS risk when interacting with some feature CVE-2024-339999.8The referrer URL used by MFA required additional sanitizing, rather than being used directly.CVE-2024-340010.0A command injection as a result of arbitrary file creation vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software CVE-2024-340004.3ID numbers displayed in the lesson overview report required additional sanitizing to prevent a stored XSS risk.CVE-2024-340018.4Actions in the admin preset tool did not include the necessary token to prevent a CSRF risk.CVE-2024-340026.5In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user with both access to resto CVE-2024-340035.9In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user with both access to resto CVE-2024-340046.5In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user with both access to resto CVE-2024-340056.5In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user with both access to resto CVE-2024-340064.3The site log report required additional encoding of event descriptions to ensure any HTML in the content is displayed in plaintext instead o CVE-2024-340078.8The logout option within MFA did not include the necessary token to avoid the risk of users inadvertently being logged out via CSRF.