CVE-2024-43425 is a critical remote code execution (RCE) vulnerability affecting Moodle, specifically within its calculated question types. This flaw, rated with a CVSS score of 8.1 (High), allows an attacker to execute arbitrary code on the server, leading to high impact on confidentiality, integrity, and availability, though it requires the capability to add or update questions. While not currently on the CISA KEV list, public exploit modules for Metasploit and Nuclei, along with an ExploitDB entry, confirm readily available exploit code. Despite this, community discussion and media coverage remain low.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 4.1.12CPE matchmatch criteria | cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:* | ||
>= 4.2.0, < 4.2.9CPE matchmatch criteria | cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:* | ||
>= 4.3.0, < 4.3.6CPE matchmatch criteria | cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:* | ||
>= 4.4.0, < 4.4.2CPE matchmatch criteria | cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.