How severe is CVE-2024-43429?

CVE-2024-43429 has a CVSS 3.x base score of 5.3, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is low, integrity none, and availability none.

Is CVE-2024-43429 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (24th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2024-43429?

CVE-2024-43429 affects Moodle. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2024-43429?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2024-43429 have an EU (EUVD) identifier?

Yes. CVE-2024-43429 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-3232.

When was CVE-2024-43429 published?

CVE-2024-43429 was published on 2024-11-11 and last updated on 2026-06-17.

CVE-2024-43429

CVE-2024-43429 is a medium-severity vulnerability in Moodle with a CVSS 3.x base score of 5.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-312.

Key facts

Severity: Medium (CVSS 3.x base score 5.3)
EPSS exploit prediction: 0% (24th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2024-3232
Weakness: CWE-312
Affected product: Moodle
Published: 2024-11-11
Last modified: 2026-06-17

Description

A flaw was found in moodle. Some hidden user profile fields are visible in gradebook reports, which could result in users without the "view hidden user fields" capability having access to the information.

Frequently asked questions

What is CVE-2024-43429?: A flaw was found in moodle. Some hidden user profile fields are visible in gradebook reports, which could result in users without the "view hidden user fields" capability having access to the information.
How severe is CVE-2024-43429?: CVE-2024-43429 has a CVSS 3.x base score of 5.3, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is low, integrity none, and availability none.
Is CVE-2024-43429 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (24th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2024-43429?: CVE-2024-43429 affects Moodle. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2024-43429?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2024-43429 have an EU (EUVD) identifier?: Yes. CVE-2024-43429 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-3232.
When was CVE-2024-43429 published?: CVE-2024-43429 was published on 2024-11-11 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*

More vulnerabilities in Moodle

CVE-2006-4935 — Critical (CVSS 10.0): The Database module in Moodle before 1.6.2 does not properly handle uploaded files, which has unspecified impact and…
CVE-2006-4936 — Critical (CVSS 10.0): Moodle before 1.6.2 does not properly validate the module instance id when creating a course module object, which has…
CVE-2005-2247 — Critical (CVSS 10.0): Multiple unknown vulnerabilities in Moodle before 1.5.1 have unknown impact and attack vectors.
CVE-2004-2233 — Critical (CVSS 10.0): Unknown "front page vulnerability with Moodle servers" for Moodle before 1.3.2 has unknown impact and attack vectors.
CVE-2004-2236 — Critical (CVSS 10.0): Unknown vulnerability in Moodle before 1.3.3 has unknown impact and attack vectors, related to language setting.
CVE-2004-2237 — Critical (CVSS 10.0): Unknown vulnerability in Moodle before 1.3.4 has unknown impact and attack vectors, related to "strings in Moodle…

All CVEs affecting Moodle →

Other CWE-312 (Cleartext Storage of Sensitive Information) vulnerabilities

CVE-2022-43757 — Critical (CVSS 9.9): A Cleartext Storage of Sensitive Information vulnerability in SUSE Rancher allows users on managed clusters to gain…
CVE-2021-36782 — Critical (CVSS 9.9): A Cleartext Storage of Sensitive Information vulnerability in SUSE Rancher allows authenticated Cluster Owners, Cluster…
CVE-2020-9045 — Critical (CVSS 9.9): During installation or upgrade to Software House C•CURE 9000 v2.70 and American Dynamics victor Video Management…
CVE-2026-31848 — Critical (CVSS 9.8): Nexxt Solutions Nebula 300+ firmware through version 12.01.01.37 uses the ecos_pw cookie for authentication, which…
CVE-2025-65826 — Critical (CVSS 9.8): The mobile application was found to contain stored credentials for the network it was developed on. If an attacker…
CVE-2025-34206 — Critical (CVSS 9.8): Vasion Print (formerly PrinterLogic) Virtual Appliance Host and Application (VA and SaaS deployments) mount host…

Browse all CWE-312 (Cleartext Storage of Sensitive Information) vulnerabilities →