A flaw was found in Moodle. Additional restrictions are required to avoid a remote code execution risk in calculated question types. Note: This requires the capability to add/update questions.

Affected Packages

Packagist moodle/moodle

Affected versions: 0 (fixed in 4.1.12)

Packagist moodle/moodle

Affected versions: 4.2.0-beta (fixed in 4.2.9)

Packagist moodle/moodle

Affected versions: 4.3.0-beta (fixed in 4.3.6)

Packagist moodle/moodle

Affected versions: 4.4.0-beta (fixed in 4.4.2)

Related CVEs

CVE-2024-43425

Key Information

GHSA ID

GHSA-v6f4-v8h8-3c87

Published

November 7, 2024 3:31 PM

Last Modified

November 7, 2024 7:27 PM

CVSS Score

7.5 /10

Primary Ecosystem

Packagist

Primary Package

moodle/moodle

GitHub Reviewed

✓ Yes

Dataset

Last updated: September 14, 2025 6:31 AM

Data from GitHub Advisory Database. This information is provided for research and educational purposes.