CVE-2024-34006
moodle: unsanitized HTML in site log for config_log_created
The site log report required additional encoding of event descriptions to ensure any HTML in the content is displayed in plaintext instead of being rendered.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
moodle: unsanitized HTML in site log for config_log_created
The site log report required additional encoding of event descriptions to ensure any HTML in the content is displayed in plaintext instead of being rendered.
- Record
CVE-2024-34006- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - Weakness
- CWE-838
- Updated
- 2026-11-02
EUVDEUVD-2024-1818
The site log report required additional encoding of event descriptions to ensure any HTML in the content is displayed in plaintext instead of being rendered.
- Record
EUVD-2024-1818- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-vvh5-7v3m-j3mj
Moodle Unsanitized HTML in site log for config_log_created
The site log report required additional encoding of event descriptions to ensure any HTML in the content is displayed in plaintext instead of being rendered.
- Record
GHSA-vvh5-7v3m-j3mj- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - Weakness
- CWE-838
- Updated
- 2026-11-02
NVD
The site log report required additional encoding of event descriptions to ensure any HTML in the content is displayed in plaintext instead of being rendered.
- Record
CVE-2024-34006- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - Weakness
- CWE-838
- Updated
- 2026-11-02
OSV
moodle: unsanitized HTML in site log for config_log_created
The site log report required additional encoding of event descriptions to ensure any HTML in the content is displayed in plaintext instead of being rendered.
- Record
CVE-2024-34006- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - Weakness
- CWE-838
- Updated
- 2026-11-02
OSVGHSA-vvh5-7v3m-j3mj
Moodle Unsanitized HTML in site log for config_log_created
The site log report required additional encoding of event descriptions to ensure any HTML in the content is displayed in plaintext instead of being rendered.
- Record
GHSA-vvh5-7v3m-j3mj- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - Weakness
- CWE-838
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2024-34006
The site log report required additional encoding of event descriptions to ensure any HTML in the content is displayed in plaintext instead of being rendered.
- Record
UBUNTU-CVE-2024-34006- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVBIT-moodle-2024-34006 No score
moodle: unsanitized HTML in site log for config_log_created
The site log report required additional encoding of event descriptions to ensure any HTML in the content is displayed in plaintext instead of being rendered.
- Record
BIT-moodle-2024-34006- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
moodle/moodlePackagist |
4.3.0 up to 4.3.4 | 4.3.4 |
moodle/moodlePackagist |
4.2.0 up to 4.2.7 | 4.2.7 |
moodle/moodlePackagist |
before 4.1.10 | 4.1.10 |
moodleBitnami |
before 4.1.10, 4.2.0 up to 4.2.7, 4.3.0 up to 4.3.4 | 4.1.104.2.74.3.4 |
moodle/moodlePackagist |
4.3.0 up to 4.3.4, plus listed versions v4.3.0v4.3.1v4.3.2v4.3.3 |
4.3.4 |
moodle/moodlePackagist |
4.2.0 up to 4.2.7, plus listed versions v4.2.0v4.2.1v4.2.2v4.2.3v4.2.4v4.2.5v4.2.6 |
4.2.7 |
moodle/moodlePackagist |
before 4.1.10, plus listed versions v2.3.10v2.3.11v2.3.4v2.3.5v2.3.6 Show 45 moreShow lessv2.3.7v2.3.8v2.3.9v2.4.0v2.4.0-rc1v2.4.1v2.4.10v2.4.11v2.4.2v2.4.3v2.4.4v2.4.5v2.4.6v2.4.7v2.4.8v2.4.9v2.5.0v2.5.0-betav2.5.0-rc1v2.5.1v2.5.2v2.5.3v2.5.4v2.5.5v2.5.6v2.5.7v2.5.8v2.5.9v2.6.0v2.6.0-betav2.6.0-rc1v2.6.1v2.6.10v2.6.11v2.6.2v2.6.3v2.6.4v2.6.5v2.6.6v2.6.7v2.6.8v2.6.9v2.7.0v2.7.0-betav2.7.0-rc1 |
4.1.10 |
moodleUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 2.7.9+dfsg-12.7.10+dfsg-12.7.11+dfsg-12.7.11+dfsg-22.7.12+dfsg-13.0.3+dfsg-0ubuntu13.0.3+dfsg-0ubuntu1+esm1 |
None known |
moodleUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 3.0.3+dfsg-0ubuntu13.0.3+dfsg-0ubuntu1+esm1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-34006 is a medium vulnerability (CVSS 4.3) in Moodle, published May 31, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.36%, the 29th percentile. Fixed in moodle/moodle 4.3.4.
References
Left out here: 292 versions. The JSON record has them.