CVE-2024-43425

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

A flaw was found in Moodle. Additional restrictions are required to avoid a remote code execution risk in calculated question types. Note: This requires the capability to add/update questions.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

Vendor	Product	Versions
—	—	< 4.1.12; >= 4.2, < 4.2.9; >= 4.3, < 4.3.6; >= 4.4, < 4.4.2
moodle	moodle	< 4.1.12; >= 4.2, < 4.2.9; >= 4.3, < 4.3.6; >= 4.4, < 4.4.2

References

https://bugzilla.redhat.com/show_bug.cgi?id=2304253Permissions Required
https://moodle.org/mod/forum/discuss.php?d=461193Vendor Advisory

Timeline

Published: Nov 7, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-434267.5A flaw was found in pdfTeX. Insufficient sanitizing in the TeX notation filter resulted in an arbitrary file read risk on sites where pdfTeX CVE-2024-434273.7A flaw was found in moodle. When creating an export of site administration presets, some sensitive secrets and keys are not being excluded f CVE-2024-434287.1To address a cache poisoning risk in Moodle, additional validation for local storage was required.CVE-2024-434295.3A flaw was found in moodle. Some hidden user profile fields are visible in gradebook reports, which could result in users without the "view CVE-2024-43439.8A Python command injection vulnerability exists in the `SagemakerLLM` class's `complete()` method within `./private_gpt/components/llm/custo CVE-2024-434305.3A flaw was found in moodle. External API access to Quiz can override contained insufficient access control.CVE-2024-434317.5A vulnerability was found in Moodle. Insufficient capability checks made it possible to delete badges that a user does not have permission t CVE-2024-434325.3A flaw was found in moodle. The cURL wrapper in Moodle strips HTTPAUTH and USERPWD headers during emulated redirects, but retains other orig CVE-2024-434335.3A flaw was found in moodle. Matrix room membership and power levels are incorrectly applied and revoked for suspended Moodle users.CVE-2024-434348.1The bulk message sending feature in Moodle's Feedback module's non-respondents report had an incorrect CSRF token check, leading to a CSRF v CVE-2024-434355.3A flaw was found in moodle. Insufficient capability checks make it possible for users with access to restore glossaries in courses to restor CVE-2024-434367.2A SQL injection risk flaw was found in the XMLDB editor tool available to site administrators.