Cross-Site Scripting Vulnerability in MOODLE by MOODLE HQ
CVE-2024-29374

Currently unrated

Key Information:

Vendor

MOODLE HQ

Status
MOODLE
Vendor
CVE Published:
21 March 2024

What is CVE-2024-29374?

A Cross-Site Scripting (XSS) vulnerability has been identified in MOODLE 3.10.9, which can be exploited via the 'GET /?lang=' URL parameter. This flaw allows an attacker to inject malicious scripts into web pages viewed by users, potentially compromising user data and session integrity. It is crucial for administrators to apply the latest patches and implement security measures to mitigate this risk.

References

https://gist.github.com/fir3storm/f9c7f3ec1a6496498517ed2...

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.