Medium severity6.2NVD Advisory· Published May 31, 2024· Updated Jun 17, 2026

CVE-2024-33996

Description

Incorrect validation of allowed event types in a calendar web service made it possible for some users to create events with types/audiences they did not have permission to publish to.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
moodle/moodlePackagist	>= 4.3.0, < 4.3.4	4.3.4
moodle/moodlePackagist	>= 4.2.0, < 4.2.7	4.2.7
moodle/moodlePackagist	< 4.1.10	4.1.10

Affected products

Moodle/Moodle2 versions
cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*range: <4.1.10
- (no CPE)range: 4.0
osv-coords2 versions
pkg:bitnami/moodle pkg:composer/moodle/moodle
< 4.1.10+ 1 more
- (no CPE)range: < 4.1.10
- (no CPE)range: >= 4.3.0, < 4.3.4

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-4qww-rxq6-x7gfghsaADVISORY
moodle.org/mod/forum/discuss.phpnvdVendor AdvisoryWEB
nvd.nist.gov/vuln/detail/CVE-2024-33996ghsaADVISORY

News mentions

No linked articles in our index yet.

cvss	0.403
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000