moodle: broken access control when setting calendar event type (CVE-2024-33996)
Affects moodleSource GCVE Database
No CVSS score published yet
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 0.4% chance of exploitation in 30 days – higher than 29% of CVEs
- Patch
- Available – fixed in 4.1.10, 4.2.7, 4.3.4
What to do
AI-suggested
A patch is available for this vulnerability. It is recommended to upgrade affected Moodle installations to versions 4.1.10 or later, 4.2.7 or later, or 4.3.4 or later to remediate the issue. No additional mitigation actions are indicated by the vendor advisory.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
Bitnamimoodlepkg:bitnami/moodleOther threats | Affected
| Fixed in
|
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
A vulnerability in Moodle's calendar web service allows some users to create calendar events with types or audiences they are not authorized to publish to due to improper validation of allowed event types. This issue affects multiple Moodle versions prior to specific fixed releases. The vulnerability has a medium severity rating and a patch is available to address the issue.