CVE-2024-34003

2024-05-3121:15:09

CWE-200

[email protected]

web.nvd.nist.gov

shared hosting

misconfiguration

moodle

local file include

CVSS3

5.9

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L

AI Score

6.5

Confidence

Low

EPSS

Percentile

9.0%

JSON

In a shared hosting environment that has been misconfigured to allow access to other users’ content, a Moodle user with both access to restore workshop modules and direct access to the web server outside of the Moodle webroot could execute a local file include.