Lucene search

GitHub Advisory DatabaseGHSA-R99Q-HMQV-XW8W

HistoryMay 31, 2024 - 9:30 p.m.

Moodle Authenticated LFI risk in some misconfigured shared hosting environments

2024-05-3121:30:55

CWE-200

GitHub Advisory Database

github.com

moodle

lfi

shared hosting

misconfiguration

web server

database activity

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

AI Score

6.5

Confidence

High

EPSS

Percentile

9.0%

JSON

In a shared hosting environment that has been misconfigured to allow access to other users’ content, a Moodle user with both access to restore database activity modules and direct access to the web server outside of the Moodle webroot could execute a local file include.

Affected configurations

Vulners

Node

moodlemoodleRange<4.1.10

moodlemoodleRange4.2.0–4.2.7

moodlemoodleRange4.3.0–4.3.4

VendorProductVersionCPE
moodlemoodle*cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
moodle	moodle	*	cpe:2.3:a:moodle:moodle::::::::

References

github.com/advisories/GHSA-r99q-hmqv-xw8w

moodle.org/mod/forum/discuss.php?d=458394

nvd.nist.gov/vuln/detail/CVE-2024-34005

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

AI Score

6.5

Confidence

High

EPSS

Percentile

9.0%

JSON

Related for GHSA-R99Q-HMQV-XW8W