Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.2

Moodle lets users add unauthorized calendar event types

CVE-2024-33996 · published 2 years ago
Summary

Moodle's calendar feature does not properly check who can create certain event types or audiences. As a result, some users could add events that should be restricted to others, potentially exposing private information or causing scheduling confusion. Update Moodle to the latest release that fixes the validation logic, and verify that only approved users can create each event type.

What to do
  • Update moodle moodle to version 4.3.4.
  • Update moodle moodle to version 4.2.7.
  • Update moodle moodle to version 4.1.10.
Affected software
Ecosystem VendorProductAffected versions
composer moodle moodle >= 4.3.0, < 4.3.4
>= 4.2.0, < 4.2.7
< 4.1.10
Fix: upgrade to 4.3.4
Ubuntu:16.04:LTS canonical moodle All versions
Original advisory text
moodle: broken access control when setting calendar event type
Incorrect validation of allowed event types in a calendar web service made it possible for some users to create events with types/audiences they did not have permission to publish to.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
6.2 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-20Improper Input Validation
Timeline
Published31 May 2024
Updated4 Nov 2026
First seen6 Mar 2026
Sources
GHSA-4qww-rxq6-x7gf · GHSA
CVE-2024-33996 · NVD
UBUNTU-CVE-2024-33996 · OSV
CVE-2024-33996 · OSV
Track software like this
Free during beta