CVE-2024-43427
Moodle: admin presets export tool includes some secrets that should not be exported
A flaw was found in moodle. When creating an export of site administration presets, some sensitive secrets and keys are not being excluded from the export, which could result in them unintentionally being leaked if the presets are shared with a third party.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Moodle: admin presets export tool includes some secrets that should not be exported
A flaw was found in moodle. When creating an export of site administration presets, some sensitive secrets and keys are not being excluded from the export, which could result in them unintentionally being leaked if the presets are shared with a third party.
- Record
CVE-2024-43427- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-922
- Updated
- 2026-11-02
EUVDEUVD-2024-3319
A flaw was found in moodle. When creating an export of site administration presets, some sensitive secrets and keys are not being excluded from the export, which could result in them unintentionally being leaked if the presets are shared with a third party.
- Record
EUVD-2024-3319- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-vpq5-56jj-vf2m
Moodle admin presets export tool includes some secrets that should not be exported
A flaw was found in moodle. When creating an export of site administration presets, some sensitive secrets and keys are not being excluded from the export, which could result in them unintentionally being leaked if the presets are shared with a third party.
- Record
GHSA-vpq5-56jj-vf2m- CVSS 4.0
- 1.7 Low
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U - CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-922
- Updated
- 2026-11-02
NVD
A flaw was found in moodle. When creating an export of site administration presets, some sensitive secrets and keys are not being excluded from the export, which could result in them unintentionally being leaked if the presets are shared with a third party.
- Record
CVE-2024-43427- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-922
- Updated
- 2026-11-02
OSV
Moodle: admin presets export tool includes some secrets that should not be exported
A flaw was found in moodle. When creating an export of site administration presets, some sensitive secrets and keys are not being excluded from the export, which could result in them unintentionally being leaked if the presets are shared with a third party.
- Record
CVE-2024-43427- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSVGHSA-vpq5-56jj-vf2m
Moodle admin presets export tool includes some secrets that should not be exported
A flaw was found in moodle. When creating an export of site administration presets, some sensitive secrets and keys are not being excluded from the export, which could result in them unintentionally being leaked if the presets are shared with a third party.
- Record
GHSA-vpq5-56jj-vf2m- CVSS 4.0
- 1.7 Low
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U - CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-922
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2024-43427
A flaw was found in moodle. When creating an export of site administration presets, some sensitive secrets and keys are not being excluded from the export, which could result in them unintentionally being leaked if the presets are shared with a third party.
- Record
UBUNTU-CVE-2024-43427- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSVBIT-moodle-2024-43427 No score
Moodle: admin presets export tool includes some secrets that should not be exported
A flaw was found in moodle. When creating an export of site administration presets, some sensitive secrets and keys are not being excluded from the export, which could result in them unintentionally being leaked if the presets are shared with a third party.
- Record
BIT-moodle-2024-43427- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
moodle/moodlePackagist |
4.4.0 up to 4.4.2 | 4.4.2 |
moodle/moodlePackagist |
4.3.0 up to 4.3.6 | 4.3.6 |
moodle/moodlePackagist |
4.2.0 up to 4.2.9 | 4.2.9 |
moodle/moodlePackagist |
before 4.1.12 | 4.1.12 |
moodleBitnami |
before 4.1.12, 4.2.0 up to 4.2.9, 4.3.0 up to 4.3.6, 4.4.0 up to 4.4.2 | 4.1.124.2.94.3.64.4.2 |
moodle/moodlePackagist |
4.4.0 up to 4.4.2, plus listed versions v4.4.0v4.4.1 |
4.4.2 |
moodle/moodlePackagist |
4.3.0 up to 4.3.6, plus listed versions v4.3.0v4.3.1v4.3.2v4.3.3v4.3.4v4.3.5 |
4.3.6 |
moodle/moodlePackagist |
4.2.0 up to 4.2.9, plus listed versions v4.2.0v4.2.1v4.2.2v4.2.3v4.2.4 Show 4 moreShow lessv4.2.5v4.2.6v4.2.7v4.2.8 |
4.2.9 |
moodle/moodlePackagist |
before 4.1.12, plus listed versions v2.3.10v2.3.11v2.3.4v2.3.5v2.3.6 Show 45 moreShow lessv2.3.7v2.3.8v2.3.9v2.4.0v2.4.0-rc1v2.4.1v2.4.10v2.4.11v2.4.2v2.4.3v2.4.4v2.4.5v2.4.6v2.4.7v2.4.8v2.4.9v2.5.0v2.5.0-betav2.5.0-rc1v2.5.1v2.5.2v2.5.3v2.5.4v2.5.5v2.5.6v2.5.7v2.5.8v2.5.9v2.6.0v2.6.0-betav2.6.0-rc1v2.6.1v2.6.10v2.6.11v2.6.2v2.6.3v2.6.4v2.6.5v2.6.6v2.6.7v2.6.8v2.6.9v2.7.0v2.7.0-betav2.7.0-rc1 |
4.1.12 |
moodleUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 2.7.9+dfsg-12.7.10+dfsg-12.7.11+dfsg-12.7.11+dfsg-22.7.12+dfsg-13.0.3+dfsg-0ubuntu13.0.3+dfsg-0ubuntu1+esm1 |
None known |
moodleUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 3.0.3+dfsg-0ubuntu13.0.3+dfsg-0ubuntu1+esm1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-43427 is a low vulnerability (CVSS 3.7) in Moodle, published November 11, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.34%, the 27th percentile. Fixed in moodle/moodle 4.4.2.
References
bugzilla.redhat.com/show_bug.cgi?id=2304255
moodle.org/mod/forum/discuss.php?d=461195
nvd.nist.gov/vuln/detail/CVE-2024-43427
git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-79373
github.com/advisories/GHSA-vpq5-56jj-vf2m
ubuntu.com/security/CVE-2024-43427
cve.org/CVERecord?id=CVE-2024-43427
Left out here: 294 versions. The JSON record has them.