CVE-2024-43430

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

A flaw was found in moodle. External API access to Quiz can override contained insufficient access control.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-276

Affected software

No affected versions have been published.

Timeline

Published
Nov 11, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-434317.5A vulnerability was found in Moodle. Insufficient capability checks made it possible to delete badges that a user does not have permission tCVE-2024-434325.3A flaw was found in moodle. The cURL wrapper in Moodle strips HTTPAUTH and USERPWD headers during emulated redirects, but retains other origCVE-2024-434335.3A flaw was found in moodle. Matrix room membership and power levels are incorrectly applied and revoked for suspended Moodle users.CVE-2024-434348.1The bulk message sending feature in Moodle's Feedback module's non-respondents report had an incorrect CSRF token check, leading to a CSRF vCVE-2024-434355.3A flaw was found in moodle. Insufficient capability checks make it possible for users with access to restore glossaries in courses to restorCVE-2024-434367.2A SQL injection risk flaw was found in the XMLDB editor tool available to site administrators.CVE-2024-434376.1A flaw was found in moodle. Insufficient sanitizing of data when performing a restore could result in a cross-site scripting (XSS) risk fromCVE-2024-434387.5A flaw was found in Feedback. Bulk messaging in the activity's non-respondents report did not verify message recipients belonging to the setCVE-2024-434396.1A flaw was found in moodle. H5P error messages require additional sanitizing to prevent a reflected cross-site scripting (XSS) risk.CVE-2024-43444.3The Shield Security – Smart Bot Blocking & Intrusion Prevention Security plugin for WordPress is vulnerable to Cross-Site Request Forgery inCVE-2024-434407.5A flaw was found in moodle. A local file may include risks when restoring block backups.CVE-2024-434419.8Authentication Bypass by Assumed-Immutable Data vulnerability in Apache HugeGraph-Server. This issue affects Apache HugeGraph-Server: from
CVE-2024-43430: Medium severity, CVSS 5.3 | Vulnix