CVE-2024-29374

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-29374
A Cross-Site Scripting (XSS) vulnerability exists in the way MOODLE 3.10.9 handles user input within the "GET /?lang=" URL parameter.

6.1 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://gist.github.com/fir3storm/f9c7f3ec1a6496498517ed216d2640b2 Exploit Third Party Advisory
https://gist.github.com/fir3storm/f9c7f3ec1a6496498517ed216d2640b2 Exploit Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:moodle:moodle:3.10.9:*:*:*:*:*:*:*
History

01 May 2025, 15:05

Type Values Removed Values Added
First Time Moodle moodle
Moodle
References () https://gist.github.com/fir3storm/f9c7f3ec1a6496498517ed216d2640b2 - () https://gist.github.com/fir3storm/f9c7f3ec1a6496498517ed216d2640b2 - Exploit, Third Party Advisory
CPE cpe:2.3:a:moodle:moodle:3.10.9:*:*:*:*:*:*:*

21 Nov 2024, 09:07

Type Values Removed Values Added
References () https://gist.github.com/fir3storm/f9c7f3ec1a6496498517ed216d2640b2 - () https://gist.github.com/fir3storm/f9c7f3ec1a6496498517ed216d2640b2 -

15 Aug 2024, 20:35

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 6.1
CWE CWE-79
Summary
  • (es) Existe una vulnerabilidad de cross-site scripting (XSS) en la forma en que MOODLE 3.10.9 maneja la entrada del usuario dentro del parámetro URL "GET /?lang=".

21 Mar 2024, 19:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-03-21 19:15

Updated : 2025-05-01 15:05

NVD link : CVE-2024-29374

Mitre link : CVE-2024-29374

CVE.ORG link : CVE-2024-29374

JSON object : View

Products Affected

moodle

  • moodle
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')