CVE-2024-43435

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

A flaw was found in moodle. Insufficient capability checks make it possible for users with access to restore glossaries in courses to restore them into the global site glossary.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-754

Affected software

Vendor	Product	Versions
—	—	< 4.1.12; >= 4.2, < 4.2.9; >= 4.3, < 4.3.6; >= 4.4, < 4.4.2
moodle	moodle	< 4.1.12; >= 4.2, < 4.2.9; >= 4.3, < 4.3.6; >= 4.4, < 4.4.2

References

https://bugzilla.redhat.com/show_bug.cgi?id=2304263Permissions Required
https://moodle.org/mod/forum/discuss.php?d=461205Vendor Advisory

Timeline

Published: Nov 11, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-434367.2A SQL injection risk flaw was found in the XMLDB editor tool available to site administrators.CVE-2024-434376.1A flaw was found in moodle. Insufficient sanitizing of data when performing a restore could result in a cross-site scripting (XSS) risk from CVE-2024-434387.5A flaw was found in Feedback. Bulk messaging in the activity's non-respondents report did not verify message recipients belonging to the set CVE-2024-434396.1A flaw was found in moodle. H5P error messages require additional sanitizing to prevent a reflected cross-site scripting (XSS) risk.CVE-2024-43444.3The Shield Security – Smart Bot Blocking & Intrusion Prevention Security plugin for WordPress is vulnerable to Cross-Site Request Forgery in CVE-2024-434407.5A flaw was found in moodle. A local file may include risks when restoring block backups.CVE-2024-434419.8Authentication Bypass by Assumed-Immutable Data vulnerability in Apache HugeGraph-Server. This issue affects Apache HugeGraph-Server: from CVE-2024-434424.9Improper Neutralization of Input done by an attacker with admin privileges ('Cross-site Scripting') in OTRS (System Configuration modules) CVE-2024-434434.9Improper Neutralization of Input done by an attacker with admin privileges ('Cross-site Scripting') in Process Management modules of OTRS an CVE-2024-434448.2Passwords of agents and customers are displayed in plain text in the OTRS admin log module if certain configurations regarding the authentic CVE-2024-434455.4A vulnerability exists in OTRS and ((OTRS Community Edition)) that fail to set the HTTP response header X-Content-Type-Options to nosniff. A CVE-2024-434463.5An improper privilege management vulnerability in OTRS Generic Interface module allows change of the Ticket status even if the user only has