Lucene search
GitHub Advisory DatabaseGHSA-MM9P-XWFM-3FQFHistoryMay 31, 2024 - 9:30 p.m.
Moodle Authenticated LFI risk in some misconfigured shared hosting environments
2024-05-3121:30:55
CWE-200
GitHub Advisory Database
github.com
1
moodle
authenticated
lfi
misconfigured
shared hosting
web server
file include
software
In a shared hosting environment that has been misconfigured to allow access to other users’ content, a Moodle user with both access to restore feedback modules and direct access to the web server outside of the Moodle webroot could execute a local file include.
Affected configurations
Node
moodlemoodleRange<4.1.10
ORmoodlemoodleRange<4.2.7
ORmoodlemoodleRange<4.3.4
| CPE | Name | Operator | Version |
|---|---|---|---|
| moodle/moodle | lt | 4.1.10 | |
| moodle/moodle | lt | 4.2.7 | |
| moodle/moodle | lt | 4.3.4 |
Related
nvd
nvd
CVE-2024-34002
2024-05-31 21:15:09
cve
cve
CVE-2024-34002
2024-05-31 21:15:09
veracode
veracode
Information Exposure Through Misconfigured Permissions
2024-06-07 07:23:33
ubuntucve
ubuntucve
CVE-2024-34002
2024-05-31 00:00:00
osv
osv
cvelist
cvelist
openvas
openvas
Moodle < 4.1.10, 4.2.x < 4.2.7, 4.3.x < 4.3.4 Multiple Vulnerabilities
2024-05-14 00:00:00