CVE-2024-34000 is a stored XSS vulnerability in Moodle affecting the lesson overview report. The issue arises because ID numbers displayed in this report were not properly sanitized, allowing attackers to inject malicious scripts that persist in the system. This vulnerability affects Moodle versions prior to 4.1.10, versions from 4.2.0 up to but not including 4.2.7, and versions from 4.3.0 up to but not including 4.3.4. The vulnerability has been assigned a medium severity rating. A patch is available to remediate the issue.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the affected Moodle instance when users view the lesson overview report. This could lead to session hijacking, defacement, or other script-based attacks. However, no active exploitation in the wild has been reported.

A patch is available for this vulnerability. Users should upgrade affected Moodle installations to versions 4.1.10 or later, 4.2.7 or later, or 4.3.4 or later to remediate the issue. Applying these official fixes will prevent exploitation of the stored XSS vulnerability.