CVE-2024-34006

MEDIUM

Published May 31, 2024 Modified May 30, 2025 CWE-838

Description

The site log report required additional encoding of event descriptions to ensure any HTML in the content is displayed in plaintext instead of being rendered.

Is your site exposed to CVE-2024-34006?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

4.3

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Weakness Type (CWE)

CWE-838 CWE-838

Affected Products

Vendor	Product	Versions
moodle	moodle	< 4.1.10
moodle	moodle	4.2.0 — 4.2.7
moodle	moodle	4.3.0 — 4.3.4

References

Advisories & Patches

https://moodle.org/mod/forum/discuss.php?d=458395 https://moodle.org/mod/forum/discuss.php?d=458395

Frequently Asked Questions

What is CVE-2024-34006? +

The site log report required additional encoding of event descriptions to ensure any HTML in the content is displayed in plaintext instead of being rendered. It has a CVSS v3.1 base score of 4.3 (MEDIUM).

How severe is CVE-2024-34006? +

CVE-2024-34006 has a CVSS v3.1 score of 4.3 out of 10, rated MEDIUM. This is a medium-severity vulnerability that should be remediated as part of regular maintenance.

What products are affected by CVE-2024-34006? +

CVE-2024-34006 affects products from moodle, specifically: moodle. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2024-34006? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2026-53641

FOSSBilling is a free, open-source billing and client management system. Versions 0.6.0 through 0.7.2 have a stored cross-site scripting (XSS) …

CVE-2026-47079

Inappropriate Encoding for Output Context vulnerability in joshnuss xml_builder (XmlBuilder module) allows Content Spoofing, Cross-site Scripting. This vulnerability is associated …

CVE-2026-84463

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, a user with Knowledge Base editing rights …

CVE-2025-4052 9.8

Inappropriate implementation in DevTools in Google Chrome prior to 136.0.7103.59 allowed a remote attacker who convinced a user to engage …

CVE-2024-11702 7.5

Copying sensitive information from Private Browsing tabs on Android, such as passwords, may have inadvertently stored data in the cloud-based …

CVE-2026-55858 5.9

MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. Prior to 2.7.14, 3.3.5, 3.4.3, …