Miggo Logo
Miggo Vulnerability Database
→
CVE-2024-43437

CVE-2024-43437: Moodle Cross-site Scripting vulnerability

5.4

CVSS Score
3.1

Basic Information

CVE ID
CVE-2024-43437
GHSA ID
GHSA-4hjf-6pxr-549h
EPSS Score
0.44091%
CWE
CWE-79
Published
11/11/2024
Updated
11/12/2024
KEV Status
No
Technology
TechnologyPHP

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
moodle/moodlecomposer>= 4.4.0, < 4.4.24.4.2
moodle/moodlecomposer>= 4.3.0, < 4.3.64.3.6
moodle/moodlecomposer>= 4.2.0, < 4.2.94.2.9
moodle/moodlecomposer< 4.1.124.1.12

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from improper sanitization during backup restoration. The commit MDL-81394 explicitly addresses formatting backup metadata safely, indicating functions handling backup metadata display were vulnerable. Moodle's restore_controller and UI renderers are central to processing and displaying backup details. Without proper escaping in these components, XSS could occur. While the exact code changes are unavailable, the commit message and security advisory strongly implicate these areas. Confidence is medium due to reliance on contextual clues rather than direct code analysis.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

* *l*w w*s *oun* in moo*l*. Insu**i*i*nt s*nitizin* o* **t* w**n p*r*ormin* * r*stor* *oul* r*sult in * *ross-sit* s*riptin* (XSS) risk *rom m*li*ious ***kup *il*s.

Reasoning

T** vuln*r**ility st*ms *rom improp*r s*nitiz*tion *urin* ***kup r*stor*tion. T** *ommit M*L-***** *xpli*itly ***r*ss*s *orm*ttin* ***kup m*t***t* s***ly, in*i**tin* *un*tions **n*lin* ***kup m*t***t* *ispl*y w*r* vuln*r**l*. Moo*l*'s r*stor*_*ontrol