CVE-2024-38277

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

A unique key should be generated for a user's QR login key and their auto-login key, so the same key cannot be used interchangeably between the two.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-324CWE-326

Affected software

VendorProductVersions
MoodleMoodle4.4; >= 4.3, <= 4.3.4; >= 4.2, <= 4.2.7; >= 4.1, <= 4.1.10

References

Timeline

Published
Jun 18, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-382786.6A vulnerability has been identified in RUGGEDCOM RMC8388 V5.X (All versions < V5.9.0), RUGGEDCOM RMC8388NC V5.X (All versions < V5.9.0), RUGCVE-2024-382794.6The affected product is vulnerable to an attacker modifying the bootloader by using custom arguments to bypass authentication and gain accesCVE-2024-38288.8The Spectra Pro plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.1.5. This is due to the pCVE-2024-382804.6An unauthorized user is able to gain access to sensitive data, including credentials, by physically retrieving the hard disk of the product CVE-2024-382819.8An attacker can access the maintenance console using hard coded credentials for a hidden wireless network on the device.CVE-2024-382828.5Utilizing default credentials, an attacker is able to log into the camera's operating system which could allow changes to be made to the opeCVE-2024-382835.1Sensitive customer information is stored in the device without encryption.CVE-2024-382848.7Transmitted data is logged between the device and the backend service. An attacker could use these logs to perform a replay attack to replicCVE-2024-382857.0Logs storing credentials are insufficiently protected and can be decoded through the use of open source tools.CVE-2024-382867.5Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 throuCVE-2024-382879.8The password-reset mechanism in the Forgot Password functionality in R-HUB TurboMeeting through 8.x allows unauthenticated remote attackers CVE-2024-382887.2A command-injection issue in the Certificate Signing Request (CSR) functionality in R-HUB TurboMeeting through 8.x allows authenticated atta
CVE-2024-38277: Medium severity, CVSS 5.4 | Vulnix