CVE-2024-25982 | BDVDB-2026-225002 Detail
Description#
The link to update all installed language packs did not include the necessary token to prevent a CSRF risk.
Impact#
Per CVSS v3.1: confidentiality impact low, integrity impact none, availability impact none. Attack vector: network.
Weaknesses#
- CWE-352 Cross-Site Request Forgery (CSRF)
References#
- http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-54749
- https://bugzilla.redhat.com/show_bug.cgi?id=2264098
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KXGBYJ43BUEBUAQZU3DT5I5A3YLF47CB/
- https://moodle.org/mod/forum/discuss.php?d=455638
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.