CVE-2024-43425

highpriority · attend · 73EPSS 0.875 · 100 %ileexploit · weaponizedDEEURUUS

grimoire priorityP1 · Urgent

Exploitable?

Public exploit

7 exploits · weaponized

Likely / severe?

87.5% (100th) EPSS

CVSS 8.1 · high

Is it mine?

25 products

Check your exposure

Who says so?

6 sources

cnnvd · enisa_euvd · fstec_bdu · osv

EPSS · scored 2026-10-27

A flaw was found in Moodle. Additional restrictions are required to avoid a remote code execution risk in calculated question types. Note: This requires the capability to add/update questions.

cvss

Technical severity, 0–10. One row per scoring source.

8.8

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.18.1highCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USexploitability 2.2 · impact 5.9

v3.18.8highAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU

v3.18.1highCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · ENISA EU

v3.18.1highCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · patrick@puiterwijk.orgexploitability 2.2 · impact 5.9

v3.18.1highCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · OSV

v3.18.1highCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:Hsecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-94USCWE-94USCWE-94US

exploits (7)

Public proof-of-concept and weaponised exploit code.

exploit/linux/http/moodle_rceMoodle Remote Code Execution (CVE-2024-43425)weaponized · metasploit
EDB-52350Moodle 4.4.0 - Authenticated Remote Code ExecutionPoC · exploit_db
RedTeamPentesting/moodle-rce-calculatedquestionsScripts for Analysis of a RCE in Moodle Calculated Questions (CVE-2024-43425)PoC · poc_in_github
Snizi/Moodle-CVE-2024-43425-ExploitSnizi/Moodle-CVE-2024-43425-ExploitPoC · poc_in_github
Tnot123/cve-2024-43425Tnot123/cve-2024-43425PoC · poc_in_github
aninfosec/CVE-2024-43425-Pocaninfosec/CVE-2024-43425-PocPoC · poc_in_github

affected products (25)

Products and version ranges known to be affected.

Open Source Moodle <4.1.12all versionscert_bundDE
Open Source Moodle <4.2.9all versionscert_bundDE
Open Source Moodle <4.3.6all versionscert_bundDE
Open Source Moodle <4.4.2all versionscert_bundDE
Open Source Moodle< 4.1.12cert_bundDE
Open Source Moodle< 4.2.9cert_bundDE
Open Source Moodle< 4.3.6cert_bundDE
Open Source Moodle< 4.4.2cert_bundDE
Мартин Догиамас Moodle≤ 4.1.12fstec_bduRU
Мартин Догиамас Moodle4.2.0 → 4.2.9fstec_bduRU
Мартин Догиамас Moodle4.3.0 → 4.3.6fstec_bduRU
Мартин Догиамас Moodle4.4.0 → 4.4.2fstec_bduRU
ООО «Ред Софт» РЕД ОС≤ 7.3fstec_bduRU
moodle moodle< 4.1.12nvdUScpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*
moodle moodle4.2.0 → 4.2.9nvdUScpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*
moodle moodle4.3.0 → 4.3.6nvdUScpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*
moodle moodle4.4.0 → 4.4.2nvdUScpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*
Bitnami moodle< 4.1.12osvUSpkg:bitnami/moodle
Bitnami moodle4.2.0 → 4.2.9osvUSpkg:bitnami/moodle
Bitnami moodle4.3.0 → 4.3.6osvUSpkg:bitnami/moodle

showing 20 of 25

advisories (3)

Vendor and ecosystem advisories describing this.

WID-SEC-W-2024-1877Moodle: Mehrere SchwachstellenDeutsch2024-08-18csaf · cert_bundDE
Ein entfernter Angreifer kann mehrere Schwachstellen in Moodle ausnutzen, um Code auszuführen, bestimmte administrative Aufgaben durchzuführen, Informationen preiszugeben, Daten zu manipulieren, Sicherheitsmechanismen zu umgehen, Cross-Site-Scripting-Angriffe durchzuführen und eine nicht näher spezifizierte Wirkung zu erzielen.
GHSA-v6f4-v8h8-3c87Moodle Remote Code Execution vulnerability2024-11-07ghsa · osvUS
A flaw was found in Moodle. Additional restrictions are required to avoid a remote code execution risk in calculated question types. Note: This requires the capability to add/update questions.
BIT-moodle-2024-43425Moodle: remote code execution via calculated question types2025-05-02vendor · osvUS
A flaw was found in Moodle. Additional restrictions are required to avoid a remote code execution risk in calculated question types. Note: This requires the capability to add/update questions.

also known as (6)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu osv cert_bund nvd NVD CVE.org MITRE

published 2024-11-07modified 2026-06-17

references (8)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan