GHSA-x87r-37q5-mmr8HighCVSS 8.1

Moodle has CSRF risk in Feedback non-respondents report

Published
November 7, 2024
Last Modified
November 7, 2024

🔗 CVE IDs covered (1)

CVE-2024-43434 →

📋 Description

The bulk message sending feature in Moodle's Feedback module's non-respondents report had an incorrect CSRF token check, leading to a CSRF vulnerability.

🎯 Affected products4

  • composer/moodle/moodle:< 4.1.12
  • composer/moodle/moodle:>= 4.2.0-beta, < 4.2.9
  • composer/moodle/moodle:>= 4.3.0-beta, < 4.3.6
  • composer/moodle/moodle:>= 4.4.0-beta, < 4.4.2

🔗 References (4)