Moodle Authenticated LFI risk in some misconfigured shared hosting environments

2024-05-3121:30:55

Google

osv.dev

moodle

authenticated

lfi

misconfigured

hosting

webroot

web server

restore workshop modules

shared hosting

6.4 Medium

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

9.1%

JSON

In a shared hosting environment that has been misconfigured to allow access to other users’ content, a Moodle user with both access to restore workshop modules and direct access to the web server outside of the Moodle webroot could execute a local file include.

CPENameOperatorVersion
moodle/moodleeq3.9.0
moodle/moodleeq3.10.0-rc1
moodle/moodleeq3.5.3
moodle/moodleeq4.0.7
moodle/moodleeq3.1.18
moodle/moodleeq3.5.1
moodle/moodleeq2.3.10
moodle/moodleeq3.2.9
moodle/moodleeq3.0.5
moodle/moodleeq3.5.0-beta

Name	Operator	Version
moodle/moodle	eq	3.9.0
moodle/moodle	eq	3.10.0-rc1
moodle/moodle	eq	3.5.3
moodle/moodle	eq	4.0.7
moodle/moodle	eq	3.1.18
moodle/moodle	eq	3.5.1
moodle/moodle	eq	2.3.10
moodle/moodle	eq	3.2.9
moodle/moodle	eq	3.0.5
moodle/moodle	eq	3.5.0-beta