CVE-2024-38276

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Incorrect CSRF token checks resulted in multiple CSRF risks.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-352

Affected software

Vendor	Product	Versions
Moodle	Moodle	4.4; >= 4.3, <= 4.3.4; >= 4.2, <= 4.2.7; >= 4.1, <= 4.1.10

References

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/F7AZYR7EXV6E5SQE2GYTNQE3NOENJCQ6/Mailing List, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GHTIX55J4Q4LEOMLNEA4OZSWVEENQX7E/Mailing List, Third Party Advisory
https://moodle.org/mod/forum/discuss.php?d=459501Patch, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/F7AZYR7EXV6E5SQE2GYTNQE3NOENJCQ6/Mailing List, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GHTIX55J4Q4LEOMLNEA4OZSWVEENQX7E/Mailing List, Third Party Advisory
https://moodle.org/mod/forum/discuss.php?d=459501Patch, Third Party Advisory

Timeline

Published: Jun 18, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-382775.4A unique key should be generated for a user's QR login key and their auto-login key, so the same key cannot be used interchangeably between CVE-2024-382786.6A vulnerability has been identified in RUGGEDCOM RMC8388 V5.X (All versions < V5.9.0), RUGGEDCOM RMC8388NC V5.X (All versions < V5.9.0), RUG CVE-2024-382794.6The affected product is vulnerable to an attacker modifying the bootloader by using custom arguments to bypass authentication and gain acces CVE-2024-38288.8The Spectra Pro plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.1.5. This is due to the p CVE-2024-382804.6An unauthorized user is able to gain access to sensitive data, including credentials, by physically retrieving the hard disk of the product CVE-2024-382819.8An attacker can access the maintenance console using hard coded credentials for a hidden wireless network on the device.CVE-2024-382828.5Utilizing default credentials, an attacker is able to log into the camera's operating system which could allow changes to be made to the ope CVE-2024-382835.1Sensitive customer information is stored in the device without encryption.CVE-2024-382848.7Transmitted data is logged between the device and the backend service. An attacker could use these logs to perform a replay attack to replic CVE-2024-382857.0Logs storing credentials are insufficiently protected and can be decoded through the use of open source tools.CVE-2024-382867.5Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 throu CVE-2024-382879.8The password-reset mechanism in the Forgot Password functionality in R-HUB TurboMeeting through 8.x allows unauthenticated remote attackers