CVE-2024-37674 in Moodle
Summary
by MITRE • 06/20/2024
Cross Site Scripting vulnerability in Moodle CMS v3.10 allows a remote attacker to execute arbitrary code via the Field Name (name parameter) of a new activity.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/12/2026
The Cross Site Scripting vulnerability identified as CVE-2024-37674 affects Moodle CMS version 3.10 and represents a critical security flaw that enables remote code execution through improper input validation. This vulnerability specifically targets the Field Name parameter within the activity creation functionality, creating a pathway for attackers to inject malicious scripts that can be executed in the context of other users' browsers. The flaw exists due to insufficient sanitization of user-supplied input during the activity field name creation process, allowing attackers to bypass standard security controls and inject malicious JavaScript code.
The technical implementation of this vulnerability stems from the application's failure to properly validate and sanitize the name parameter when creating new activities within the Moodle environment. When administrators or users create activities with specially crafted field names containing script tags or other malicious code, the system fails to properly escape or filter these inputs before rendering them in the web interface. This creates a persistent cross site scripting condition that can be exploited by remote attackers to execute arbitrary code within the browser context of authenticated users. The vulnerability aligns with CWE-79 which specifically addresses Cross Site Scripting flaws in web applications, and represents a direct violation of secure input handling principles that should prevent untrusted data from being interpreted as executable code.
The operational impact of this vulnerability extends beyond simple script execution to potentially enable full account compromise and privilege escalation within the Moodle learning management system. Attackers can leverage this flaw to steal session cookies, redirect users to malicious sites, modify course content, or even gain administrative access if they can target privileged users. The remote nature of the attack means that threat actors do not require physical access to the system or local network presence to exploit this vulnerability, making it particularly dangerous in educational environments where multiple users interact with the platform. This vulnerability can be exploited through various attack vectors including phishing emails, compromised user accounts, or direct web interface manipulation, and the attack can be automated to target multiple users simultaneously.
Organizations utilizing Moodle CMS version 3.10 should immediately implement mitigations including applying the latest security patches provided by Moodle developers, implementing input validation controls at the application level, and deploying web application firewalls to detect and block malicious script injection attempts. The vulnerability demonstrates the critical importance of proper input sanitization and output encoding practices, which should be implemented according to OWASP secure coding guidelines. Additionally, administrators should consider implementing content security policies to prevent script execution in the browser context, and regular security audits should be conducted to identify similar vulnerabilities in other components of the Moodle platform. The ATT&CK framework categorizes this vulnerability under T1059.007 for Scripting and T1566 for Phishing, highlighting the multi-stage attack approach that can be employed by threat actors exploiting such flaws. System administrators should also monitor for suspicious activity related to activity creation and field name modifications, as these may indicate exploitation attempts.