CVE-2023-5550

2023-11-0920:15:10

CWE-94

[email protected]

web.nvd.nist.gov

shared hosting

misconfigured

moodle

rce

remote code execution

web server

access

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.003

Percentile

71.0%

JSON

In a shared hosting environment that has been misconfigured to allow access to other users’ content, a Moodle user who also has direct access to the web server outside of the Moodle webroot could utilise a local file include to achieve remote code execution.

Affected configurations

Nvd

Node

moodlemoodleRange<3.9.24

moodlemoodleRange3.11.0–3.11.17

moodlemoodleRange4.0.0–4.0.11

moodlemoodleRange4.1.0–4.1.6

moodlemoodleRange4.2.0–4.2.3

Node

fedoraprojectextra_packages_for_enterprise_linuxMatch7.0

fedoraprojectfedoraMatch38

VendorProductVersionCPE
moodlemoodle*cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*
fedoraprojectextra_packages_for_enterprise_linux7.0cpe:2.3:a:fedoraproject:extra_packages_for_enterprise_linux:7.0:*:*:*:*:*:*:*
fedoraprojectfedora38cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
moodle	moodle	*	cpe:2.3:a:moodle:moodle::::::::
fedoraproject	extra_packages_for_enterprise_linux	7.0	cpe:2.3:a:fedoraproject:extra_packages_for_enterprise_linux:7.0:::::::*
fedoraproject	fedora	38	cpe:2.3:o:fedoraproject:fedora:38:::::::*