Stored XSS Risk in Event Deletion Prompt
CVE-2024-38274

6.1MEDIUM

Key Information:

What is CVE-2024-38274?

Insufficient escaping of calendar event titles resulted in a stored XSS risk in the event deletion prompt.

Moodle 4.4

Moodle 4.3 <= 4.3.4

Moodle 4.2 <= 4.2.7

Score:

6.1

Severity:

MEDIUM

Confidentiality:

Low

Integrity:

Low

Availability:

Low

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

None

User Interaction:

Required

Scope:

Changed

Download the Critical Vulnerability Management Cheat Sheet