CVE-2024-34006

What it actually does

Insufficient encoding of event descriptions in the site log report allows arbitrary HTML and JavaScript to render and execute in the viewing user's browser instead of displaying as plaintext.

Why it matters to the business

Administrators reviewing activity logs could be exposed to client-side code execution that alters page content or triggers unwanted actions, potentially leading to session misuse or phishing success within the application.

How an attack unfolds

An attacker triggers a logged event containing crafted HTML or script in the description field; when an administrator later views the site log report, the browser renders and executes the injected content due to missing output encoding.

How to fix it

Upgrade Moodle to the version containing commit e8d03fdae4ec30a40cdc535c8e9e95f30604ec10 or later; apply the patch that adds proper encoding to event descriptions in the log report output.

How to confirm the fix worked

Confirm the installed version includes commit e8d03fdae4ec30a40cdc535c8e9e95f30604ec10; test by injecting HTML into an event description and verifying it appears as escaped text rather than rendered markup in the log report.

Typical attack path

1. Attacker performs an action that generates a log entry with malicious HTML in the event description
2. Attacker waits for or lures an administrator to access the site log report page
3. Browser renders the unencoded content, executing the injected script in the administrator's session context

How to detect it

Inspect web server access logs and application logs for repeated or unusual accesses to the site log report page shortly after events that could contain user-controlled data; look for requests containing suspicious encoded HTML patterns in parameters that feed event descriptions.

What your security team should do

• Apply the fixed commit or upgrade Moodle immediately across all instances
• Review administrative access controls to the site log report to limit exposure
• Monitor web application firewall rules for anomalous requests targeting log report endpoints