Remote Code Execution Vulnerability in Moodle by Moodle
CVE-2024-43425

8.1HIGH

Key Information:

Vendor

Moodle
Status
Moodle
Vendor
CVE Published:
7 November 2024

Badges

👾 Exploit Exists🟡 Public PoC🟣 EPSS 89%📰 News Worthy

What is CVE-2024-43425?

A vulnerability exists within the Moodle application that allows for remote code execution due to inadequate restrictions on calculated question types. This flaw could potentially be exploited by users who have the capability to add or update questions, leading to unintended code execution risks. It's crucial for Moodle users to apply necessary updates and configurations to mitigate this risk.

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

Metasploit exploit module for CVE-2024-43425
Created by Rapid7

News Articles

favicon imageRedTeam Pentesting GmbH

RedTeam Pentesting GmbH - Moodle: Remote Code Execution via Calculated Questions

Attackers with the permission to create or modify questions in Moodle courses are able to craft malicious inputs for calculated questions, which can be abused to execute arbitrary commands on the underlying system.

References

https://bugzilla.redhat.com/show_bug.cgi?id=2304253
https://moodle.org/mod/forum/discuss.php?d=461193

EPSS Score

89% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • 📰

    First article discovered by RedTeam Pentesting GmbH

.