CVE-2024-33996 - Vulnerability Details - OpenCVE

Incorrect validation of allowed event types in a calendar web service made it possible for some users to create events with types/audiences they did not have permission to publish to.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Changed

Confidentiality Impact None

Integrity Impact High

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00182.

Key SSVC decision points have not yet been added.

Vendors	Products
Moodle	Moodle

Configuration 1 [-]

OR	cpe:2.3:a:moodle:moodle::::::::
	cpe:2.3:a:moodle:moodle::::::::
	cpe:2.3:a:moodle:moodle::::::::

No data.

No data.

Advisories

Source	ID	Title
Github GHSA	GHSA-4qww-rxq6-x7gf	Moodle broken access control when setting calendar event type

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://moodle.org/mod/forum/discuss.php?d=458384#p1840909

History

Fri, 30 May 2025 21:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Moodle Moodle moodle
Weaknesses		NVD-CWE-noinfo
CPEs		cpe:2.3:a:moodle:moodle::::::::
Vendors & Products		Moodle Moodle moodle

MITRE

Status: PUBLISHED

Assigner: fedora

Published: 2024-05-31T19:29:07.256Z

Updated: 2024-08-02T02:42:59.873Z

Reserved: 2024-04-29T13:02:30.265Z

Link: CVE-2024-33996

Vulnrichment

Updated: 2024-08-02T02:42:59.873Z

NVD

Status : Analyzed

Published: 2024-05-31T20:15:09.647

Modified: 2025-05-30T16:41:36.053

Link: CVE-2024-33996

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-33996", "assignerOrgId": "92fb86c3-55a5-4fb5-9c3f-4757b9e96dc5", "state": "PUBLISHED", "assignerShortName": "fedora", "dateReserved": "2024-04-29T13:02:30.265Z", "datePublished": "2024-05-31T19:29:07.256Z", "dateUpdated": "2024-08-02T02:42:59.873Z"}, "containers": {"cna": {"title": "moodle: broken access control when setting calendar event type", "datePublic": "2024-05-20T09:00:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-20", "description": "CWE-20 Improper Input Validation", "type": "CWE"}]}], "affected": [{"vendor": "Moodle", "product": "Moodle", "packageName": "Moodle", "versions": [{"status": "affected", "version": "4.0", "lessThanOrEqual": "4.3.3", "versionType": "semver"}, {"status": "affected", "version": "4.2", "lessThanOrEqual": "4.2.6", "versionType": "semver"}, {"status": "affected", "version": "4.1", "lessThanOrEqual": "4.1.9", "versionType": "semver"}], "defaultStatus": "unknown"}], "descriptions": [{"lang": "en", "value": "Incorrect validation of allowed event types in a calendar web service made it possible for some users to create events with types/audiences they did not have permission to publish to.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<pre>Incorrect validation of allowed event types in a calendar web service made it possible for some users to create events with types/audiences they did not have permission to publish to.</pre><br>"}]}], "references": [{"url": "https://moodle.org/mod/forum/discuss.php?d=458384#p1840909"}], "providerMetadata": {"orgId": "92fb86c3-55a5-4fb5-9c3f-4757b9e96dc5", "shortName": "fedora", "dateUpdated": "2024-05-31T19:29:07.256Z"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.2, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-33996", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-06-01T13:14:42.992969Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:moodle:moodle:4.0.0:-:*:*:*:*:*:*"], "vendor": "moodle", "product": "moodle", "versions": [{"status": "affected", "version": "4.0.0", "versionType": "custom", "lessThanOrEqual": "4.3.3"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:a:moodle:moodle:4.1.0:-:*:*:*:*:*:*"], "vendor": "moodle", "product": "moodle", "versions": [{"status": "affected", "version": "4.1.0", "versionType": "custom", "lessThanOrEqual": "4.1.9"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:a:moodle:moodle:4.2.0:*:*:*:*:*:*:*"], "vendor": "moodle", "product": "moodle", "versions": [{"status": "affected", "version": "4.2.0", "versionType": "custom", "lessThanOrEqual": "4.2.6"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-04T17:43:56.027Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T02:42:59.873Z"}, "title": "CVE Program Container", "references": [{"url": "https://moodle.org/mod/forum/discuss.php?d=458384#p1840909", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://moodle.org/mod/forum/discuss.php?d=458384#p1840909", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T02:42:59.873Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.2, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-33996", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-06-01T13:14:42.992969Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:moodle:moodle:4.0.0:-:*:*:*:*:*:*"], "vendor": "moodle", "product": "moodle", "versions": [{"status": "affected", "version": "4.0.0", "versionType": "custom", "lessThanOrEqual": "4.3.3"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:a:moodle:moodle:4.1.0:-:*:*:*:*:*:*"], "vendor": "moodle", "product": "moodle", "versions": [{"status": "affected", "version": "4.1.0", "versionType": "custom", "lessThanOrEqual": "4.1.9"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:a:moodle:moodle:4.2.0:*:*:*:*:*:*:*"], "vendor": "moodle", "product": "moodle", "versions": [{"status": "affected", "version": "4.2.0", "versionType": "custom", "lessThanOrEqual": "4.2.6"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-01T13:14:31.230Z"}}], "cna": {"title": "moodle: broken access control when setting calendar event type", "affected": [{"vendor": "Moodle", "product": "Moodle", "versions": [{"status": "affected", "version": "4.0", "versionType": "semver", "lessThanOrEqual": "4.3.3"}, {"status": "affected", "version": "4.2", "versionType": "semver", "lessThanOrEqual": "4.2.6"}, {"status": "affected", "version": "4.1", "versionType": "semver", "lessThanOrEqual": "4.1.9"}], "packageName": "Moodle", "defaultStatus": "unknown"}], "datePublic": "2024-05-20T09:00:00.000Z", "references": [{"url": "https://moodle.org/mod/forum/discuss.php?d=458384#p1840909"}], "descriptions": [{"lang": "en", "value": "Incorrect validation of allowed event types in a calendar web service made it possible for some users to create events with types/audiences they did not have permission to publish to.", "supportingMedia": [{"type": "text/html", "value": "<pre>Incorrect validation of allowed event types in a calendar web service made it possible for some users to create events with types/audiences they did not have permission to publish to.</pre><br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-20", "description": "CWE-20 Improper Input Validation"}]}], "providerMetadata": {"orgId": "92fb86c3-55a5-4fb5-9c3f-4757b9e96dc5", "shortName": "fedora", "dateUpdated": "2024-05-31T19:29:07.256Z"}}}, "cveMetadata": {"cveId": "CVE-2024-33996", "state": "PUBLISHED", "dateUpdated": "2024-08-02T02:42:59.873Z", "dateReserved": "2024-04-29T13:02:30.265Z", "assignerOrgId": "92fb86c3-55a5-4fb5-9c3f-4757b9e96dc5", "datePublished": "2024-05-31T19:29:07.256Z", "assignerShortName": "fedora"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*", "matchCriteriaId": "181FEE3D-2D75-4269-A095-C555B313E159", "versionEndExcluding": "4.1.10", "vulnerable": true}, {"criteria": "cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*", "matchCriteriaId": "B3309504-72F2-4154-AF1C-57797BFEA31B", "versionEndExcluding": "4.2.7", "versionStartIncluding": "4.2.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*", "matchCriteriaId": "BE7100F0-5F88-497E-A04D-071DFEE765C6", "versionEndExcluding": "4.3.4", "versionStartIncluding": "4.3.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Incorrect validation of allowed event types in a calendar web service made it possible for some users to create events with types/audiences they did not have permission to publish to."}, {"lang": "es", "value": "La validaci\u00f3n incorrecta de los tipos de eventos permitidos en un servicio web de calendario hizo posible que algunos usuarios crearan eventos con tipos/audiencias para los que no ten\u00edan permiso para publicar."}], "id": "CVE-2024-33996", "lastModified": "2025-05-30T16:41:36.053", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.2, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 1.7, "impactScore": 4.0, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2024-05-31T20:15:09.647", "references": [{"source": "patrick@puiterwijk.org", "tags": ["Vendor Advisory"], "url": "https://moodle.org/mod/forum/discuss.php?d=458384#p1840909"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://moodle.org/mod/forum/discuss.php?d=458384#p1840909"}], "sourceIdentifier": "patrick@puiterwijk.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}], "source": "patrick@puiterwijk.org", "type": "Secondary"}, {"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}