Moodle
CVE-2024-38277
MEDIUM
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Primary rating from Vendor (puiterwijk) · only source for this CVE.
CVSS VectorVendor: puiterwijk
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Lifecycle Timeline
1DescriptionCVE.org
A unique key should be generated for a user's QR login key and their auto-login key, so the same key cannot be used interchangeably between the two.
AnalysisAI
A unique key should be generated for a user's QR login key and their auto-login key, so the same key cannot be used interchangeably between the two. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Technical ContextAI
This vulnerability is classified under CWE-324. A unique key should be generated for a user's QR login key and their auto-login key, so the same key cannot be used interchangeably between the two. Affected products include: Moodle, Fedoraproject Fedora.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.
Moodle through 2.5.2 allows remote authenticated administrators to execute arbitrary programs by configuring the aspell
A command execution vulnerability exists in the default legacy spellchecker plugin in Moodle 3.10. Rated critical severi
A flaw was found in Moodle. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authenticatio
In Moodle 2.x and 3.x, SQL injection can occur via user preferences. Rated critical severity (CVSS 9.8), this vulnerabil
The Moodle LMS Jmol plugin version 6.1 and earlier contains a path traversal vulnerability in jsmol.php. The query param
Multiple cross-site scripting (XSS) vulnerabilities in Moodle through 2.2.11, 2.3.x before 2.3.9, 2.4.x before 2.4.6, an
Unrestricted file upload vulnerability in the double extension support in the "image" module in Moodle 3.1.2 allows remo
Unrestricted file upload vulnerability in the "legacy course files" and "file manager" modules in Moodle 3.1.2 allows re
moodle before versions 3.5.2, 3.4.5, 3.3.8, 3.1.14 is vulnerable to an XML import of ddwtos could lead to intentional re
An issue was discovered in Moodle 3.x. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low a
Moodle 3.1.2 allows remote attackers to obtain sensitive information via unspecified vectors, related to a "SQL Injectio
Moodle 3.10.3 contains a persistent cross-site scripting vulnerability in the calendar event subtitle field that allows
Same weakness CWE-324 – Use of a Key Past its Expiration Date
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today