Skip to content
CVE PROGRAM SOURCE RECORD6.1 Medium

CVE-2024-38274

moodle: stored XSS via calendar's event title when deleting the event

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
fedora

Description

Insufficient escaping of calendar event titles resulted in a stored XSS risk in the event deletion prompt.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Moodle Moodle

Default version status: unaffected

  • 4.4affected
  • 4.3 to ≤ 4.3.4affected
  • 4.2 to ≤ 4.2.7affected
  • 4.1 to ≤ 4.1.10affected

References