CVE-2024-38274

What it actually does

Insufficient escaping of user-supplied calendar event titles allows arbitrary JavaScript to execute in the context of an administrator or user viewing the event deletion confirmation prompt, resulting in stored cross-site scripting.

Why it matters to the business

Attackers can hijack user sessions, steal sensitive data, or perform unauthorized actions within the learning platform, potentially disrupting teaching, exposing student records, and requiring extensive incident response.

How an attack unfolds

An attacker with permission to create calendar events crafts a malicious title containing executable script, saves the event, and waits for a privileged user to open the deletion prompt; the script then executes in that user's browser session. No named threat actors or ransomware campaigns are associated with this issue.

How to fix it

Upgrade Moodle to the commit c8c84b4af18d50224c17a4a3193e1374fec26625 or later release that properly escapes event titles before rendering the deletion prompt.

How to confirm the fix worked

Confirm the installed codebase contains commit c8c84b4af18d50224c17a4a3193e1374fec26625; attempt to create an event with a benign script in the title and verify it is escaped in the deletion dialog.

Typical attack path

1. Obtain low-privileged account or guest access to create calendar events
2. Create a new calendar event whose title contains a crafted script payload
3. Trigger deletion workflow by a higher-privileged user who views the event
4. Script executes in the victim's browser, establishing persistence or exfiltrating data

How to detect it

Review web server and application logs for unexpected script tags or event-creation requests containing HTML entities; inspect recent calendar events for titles that include script, img, or svg elements.

What your security team should do

• Apply the fixed commit immediately given the 848 days since disclosure
• Audit all calendar events created since 2024-06-18 for suspicious titles
• Enable content-security-policy headers to limit XSS blast radius
• Review user permissions for calendar event creation