CVE-2024-43439

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

A flaw was found in moodle. H5P error messages require additional sanitizing to prevent a reflected cross-site scripting (XSS) risk.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
—	—	< 4.1.12; >= 4.2, < 4.2.9; >= 4.3, < 4.3.6; >= 4.4, < 4.4.2
moodle	moodle	< 4.1.12; >= 4.2, < 4.2.9; >= 4.4, < 4.4.2

References

https://bugzilla.redhat.com/show_bug.cgi?id=2304268Permissions Required
https://moodle.org/mod/forum/discuss.php?d=461209Vendor Advisory

Timeline

Published: Nov 11, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-43444.3The Shield Security – Smart Bot Blocking & Intrusion Prevention Security plugin for WordPress is vulnerable to Cross-Site Request Forgery in CVE-2024-434407.5A flaw was found in moodle. A local file may include risks when restoring block backups.CVE-2024-434419.8Authentication Bypass by Assumed-Immutable Data vulnerability in Apache HugeGraph-Server. This issue affects Apache HugeGraph-Server: from CVE-2024-434424.9Improper Neutralization of Input done by an attacker with admin privileges ('Cross-site Scripting') in OTRS (System Configuration modules) CVE-2024-434434.9Improper Neutralization of Input done by an attacker with admin privileges ('Cross-site Scripting') in Process Management modules of OTRS an CVE-2024-434448.2Passwords of agents and customers are displayed in plain text in the OTRS admin log module if certain configurations regarding the authentic CVE-2024-434455.4A vulnerability exists in OTRS and ((OTRS Community Edition)) that fail to set the HTTP response header X-Content-Type-Options to nosniff. A CVE-2024-434463.5An improper privilege management vulnerability in OTRS Generic Interface module allows change of the Ticket status even if the user only has CVE-2024-434478.1Windows SMBv3 Server Remote Code Execution Vulnerability CVE-2024-434496.8Windows USB Video Class System Driver Elevation of Privilege Vulnerability CVE-2024-43459.8The Startklar Elementor Addons plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the CVE-2024-434507.5Windows DNS Spoofing Vulnerability