CVE-2024-43427

Moodle: admin presets export tool includes some secrets that should not be exported

State: Published
Severity: 3.7 Low
Published: Nov 11, 2024
Updated: Nov 12, 2024
Reserved: Aug 13, 2024

Description

A flaw was found in moodle. When creating an export of site administration presets, some sensitive secrets and keys are not being excluded from the export, which could result in them unintentionally being leaked if the presets are shared with a third party.

Scores

CVSS	Score	Vector	Source
3.1	3.7 Low	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N	fedora

Weaknesses

CWE-922 Insecure Storage of Sensitive Information

Affected Products

Product	Versions
moodle	before 4.1.12Affected 4.2 to before 4.2.9Affected 4.3 to before 4.3.6Affected 4.4 to before 4.4.2Affected

References

RHBZ#2304255issue-tracking
https://moodle.org/mod/forum/discuss.php?d=461195

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.