« Volver al listado

CVE-2024-38277

Estado: AnalizadaMedia (5.4)—

A unique key should be generated for a user's QR login key and their auto-login key, so the same key cannot be used interchangeably between the two.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Fedoraproject — FedoraMoodle — Moodle

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-38277",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-38277",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-06-21T15:55:16.520252Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.4,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.5,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "patrick@puiterwijk.org",
      "affectedData": [
        {
          "vendor": "Moodle",
          "product": "Moodle",
          "versions": [
            {
              "status": "affected",
              "version": "4.4",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "4.3",
              "versionType": "semver",
              "lessThanOrEqual": "4.3.4"
            },
            {
              "status": "affected",
              "version": "4.2",
              "versionType": "semver",
              "lessThanOrEqual": "4.2.7"
            },
            {
              "status": "affected",
              "version": "4.1",
              "versionType": "semver",
              "lessThanOrEqual": "4.1.10"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2024-06-18T20:15:14.210",
  "references": [
    {
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/F7AZYR7EXV6E5SQE2GYTNQE3NOENJCQ6/",
      "tags": [
        "Mailing List"
      ],
      "source": "patrick@puiterwijk.org"
    },
    {
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GHTIX55J4Q4LEOMLNEA4OZSWVEENQX7E/",
      "tags": [
        "Mailing List"
      ],
      "source": "patrick@puiterwijk.org"
    },
    {
      "url": "https://moodle.org/mod/forum/discuss.php?d=459502",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "patrick@puiterwijk.org"
    },
    {
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/F7AZYR7EXV6E5SQE2GYTNQE3NOENJCQ6/",
      "tags": [
        "Mailing List"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GHTIX55J4Q4LEOMLNEA4OZSWVEENQX7E/",
      "tags": [
        "Mailing List"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://moodle.org/mod/forum/discuss.php?d=459502",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "patrick@puiterwijk.org",
      "description": [
        {
          "lang": "en",
          "value": "CWE-324"
        }
      ]
    },
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-326"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A unique key should be generated for a user's QR login key and their auto-login key, so the same key cannot be used interchangeably between the two."
    },
    {
      "lang": "es",
      "value": "Se debe generar una clave única para la clave de inicio de sesión QR de un usuario y su clave de inicio de sesión automático, de modo que la misma clave no se pueda usar indistintamente entre las dos."
    }
  ],
  "lastModified": "2026-06-17T07:39:51.073",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8CC28E6E-1BB0-46D9-A9BC-49E098ED1EA7",
              "versionEndExcluding": "4.1.11",
              "versionStartIncluding": "4.1.0"
            },
            {
              "criteria": "cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4EF79A9A-E117-44AF-BA6B-DC9620FDA8CE",
              "versionEndExcluding": "4.2.8",
              "versionStartIncluding": "4.2.0"
            },
            {
              "criteria": "cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4E990456-42CD-4B17-8A62-1F2ACF3B0678",
              "versionEndExcluding": "4.3.5",
              "versionStartIncluding": "4.3.0"
            },
            {
              "criteria": "cpe:2.3:a:moodle:moodle:4.4.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "23575814-D590-4CDA-880B-E7214A53D7F5"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B8EDB836-4E6A-4B71-B9B2-AA3E03E0F646"
            },
            {
              "criteria": "cpe:2.3:o:fedoraproject:fedora:40:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CA277A6C-83EC-4536-9125-97B84C4FAF59"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "patrick@puiterwijk.org"
}