CVE-2024-34006 (GCVE-0-2024-34006)
Vulnerability from cvelistv5
Published
2024-05-31 20:36
Modified
2024-08-02 02:42
Severity ?
4.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
CWE
  • CWE-838 - Inappropriate Encoding for Output Context
Summary
The site log report required additional encoding of event descriptions to ensure any HTML in the content is displayed in plaintext instead of being rendered.
References
Impacted products
Vendor Product Version
Version: 4.0   ≤ 4.3.3
Version: 4.2   ≤ 4.2.6
Version: 4.1   ≤ 4.1.9
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:o:fedoraproject:fedora:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "fedora",
            "vendor": "fedoraproject",
            "versions": [
              {
                "lessThanOrEqual": "4.3.3",
                "status": "affected",
                "version": "4.0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:fedoraproject:fedora:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "fedora",
            "vendor": "fedoraproject",
            "versions": [
              {
                "lessThanOrEqual": "4.1.9",
                "status": "affected",
                "version": "4.1",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:fedoraproject:fedora:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "fedora",
            "vendor": "fedoraproject",
            "versions": [
              {
                "lessThanOrEqual": "4.2.6",
                "status": "affected",
                "version": "4.2",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 4.3,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "LOW",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-34006",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-03T15:10:13.250364Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:42:30.475Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T02:42:59.940Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://moodle.org/mod/forum/discuss.php?d=458395"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://git.moodle.org",
          "defaultStatus": "unknown",
          "packageName": "Moodle",
          "versions": [
            {
              "lessThanOrEqual": "4.3.3",
              "status": "affected",
              "version": "4.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.2.6",
              "status": "affected",
              "version": "4.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.1.9",
              "status": "affected",
              "version": "4.1",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Leon Stringer"
        }
      ],
      "datePublic": "2024-05-20T09:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cpre\u003eThe site log report required additional encoding of event descriptions to ensure any HTML in the content is displayed in plaintext instead of being rendered.\u003c/pre\u003e\u003cbr\u003e"
            }
          ],
          "value": "The site log report required additional encoding of event descriptions to ensure any HTML in the content is displayed in plaintext instead of being rendered."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-838",
              "description": "CWE-838 Inappropriate Encoding for Output Context",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-05-31T20:36:08.390Z",
        "orgId": "92fb86c3-55a5-4fb5-9c3f-4757b9e96dc5",
        "shortName": "fedora"
      },
      "references": [
        {
          "url": "https://moodle.org/mod/forum/discuss.php?d=458395"
        }
      ],
      "title": "moodle: unsanitized HTML in site log for config_log_created"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "92fb86c3-55a5-4fb5-9c3f-4757b9e96dc5",
    "assignerShortName": "fedora",
    "cveId": "CVE-2024-34006",
    "datePublished": "2024-05-31T20:36:08.390Z",
    "dateReserved": "2024-04-29T13:02:30.267Z",
    "dateUpdated": "2024-08-02T02:42:59.940Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-34006\",\"sourceIdentifier\":\"patrick@puiterwijk.org\",\"published\":\"2024-05-31T21:15:09.533\",\"lastModified\":\"2025-05-30T16:48:15.447\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"The site log report required additional encoding of event descriptions to ensure any HTML in the content is displayed in plaintext instead of being rendered.\"},{\"lang\":\"es\",\"value\":\"El informe de registro del sitio requiri\u00f3 codificaci\u00f3n adicional de las descripciones de eventos para garantizar que cualquier HTML en el contenido se muestre en texto plano en lugar de representarse.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N\",\"baseScore\":4.3,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.8,\"impactScore\":1.4}]},\"weaknesses\":[{\"source\":\"patrick@puiterwijk.org\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-838\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-838\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"4.1.10\",\"matchCriteriaId\":\"181FEE3D-2D75-4269-A095-C555B313E159\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.2.0\",\"versionEndExcluding\":\"4.2.7\",\"matchCriteriaId\":\"B3309504-72F2-4154-AF1C-57797BFEA31B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.3.0\",\"versionEndExcluding\":\"4.3.4\",\"matchCriteriaId\":\"BE7100F0-5F88-497E-A04D-071DFEE765C6\"}]}]}],\"references\":[{\"url\":\"https://moodle.org/mod/forum/discuss.php?d=458395\",\"source\":\"patrick@puiterwijk.org\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://moodle.org/mod/forum/discuss.php?d=458395\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://moodle.org/mod/forum/discuss.php?d=458395\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T02:42:59.940Z\"}}, {\"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 4.3, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N\", \"integrityImpact\": \"LOW\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"NONE\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-34006\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-06-03T15:10:13.250364Z\"}}}], \"affected\": [{\"cpes\": [\"cpe:2.3:o:fedoraproject:fedora:-:*:*:*:*:*:*:*\"], \"vendor\": \"fedoraproject\", \"product\": \"fedora\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.0\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"4.3.3\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:o:fedoraproject:fedora:-:*:*:*:*:*:*:*\"], \"vendor\": \"fedoraproject\", \"product\": \"fedora\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.1\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"4.1.9\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:o:fedoraproject:fedora:-:*:*:*:*:*:*:*\"], \"vendor\": \"fedoraproject\", \"product\": \"fedora\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.2\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"4.2.6\"}], \"defaultStatus\": \"unknown\"}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-06-03T15:18:08.058Z\"}, \"title\": \"CISA ADP Vulnrichment\"}], \"cna\": {\"title\": \"moodle: unsanitized HTML in site log for config_log_created\", \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Leon Stringer\"}], \"affected\": [{\"versions\": [{\"status\": \"affected\", \"version\": \"4.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.3.3\"}, {\"status\": \"affected\", \"version\": \"4.2\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.2.6\"}, {\"status\": \"affected\", \"version\": \"4.1\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.1.9\"}], \"packageName\": \"Moodle\", \"collectionURL\": \"https://git.moodle.org\", \"defaultStatus\": \"unknown\"}], \"datePublic\": \"2024-05-20T09:00:00.000Z\", \"references\": [{\"url\": \"https://moodle.org/mod/forum/discuss.php?d=458395\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"The site log report required additional encoding of event descriptions to ensure any HTML in the content is displayed in plaintext instead of being rendered.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cpre\u003eThe site log report required additional encoding of event descriptions to ensure any HTML in the content is displayed in plaintext instead of being rendered.\u003c/pre\u003e\u003cbr\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-838\", \"description\": \"CWE-838 Inappropriate Encoding for Output Context\"}]}], \"providerMetadata\": {\"orgId\": \"92fb86c3-55a5-4fb5-9c3f-4757b9e96dc5\", \"shortName\": \"fedora\", \"dateUpdated\": \"2024-05-31T20:36:08.390Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-34006\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-08-02T02:42:59.940Z\", \"dateReserved\": \"2024-04-29T13:02:30.267Z\", \"assignerOrgId\": \"92fb86c3-55a5-4fb5-9c3f-4757b9e96dc5\", \"datePublished\": \"2024-05-31T20:36:08.390Z\", \"assignerShortName\": \"fedora\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.