Lucene search

GitHub Advisory DatabaseGHSA-JG4F-8W9X-JV35

HistoryMay 31, 2024 - 9:30 p.m.

Moodle Authenticated LFI risk in some misconfigured shared hosting environments

2024-05-3121:30:55

CWE-200

GitHub Advisory Database

github.com

moodle

authenticated

lfi

risk

misconfigured

shared hosting

restore workshop modules

web server

webroot

execute

local file include

software

6.4 Medium

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

9.1%

JSON

In a shared hosting environment that has been misconfigured to allow access to other users’ content, a Moodle user with both access to restore workshop modules and direct access to the web server outside of the Moodle webroot could execute a local file include.

Affected configurations

Vulners

Node

moodlemoodleRange<4.1.10

moodlemoodleRange<4.2.7

moodlemoodleRange<4.3.4

CPENameOperatorVersion
moodle/moodlelt4.1.10
moodle/moodlelt4.2.7
moodle/moodlelt4.3.4

Name	Operator	Version
moodle/moodle	lt	4.1.10
moodle/moodle	lt	4.2.7
moodle/moodle	lt	4.3.4

References

git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-80712

github.com/advisories/GHSA-jg4f-8w9x-jv35

moodle.org/mod/forum/discuss.php?d=458391

nvd.nist.gov/vuln/detail/CVE-2024-34003