GHSA-5cvx-cwpx-9rjhMediumCVSS 6.5

Moodle Code Injection vulnerability

Published
November 9, 2023
Last Modified
November 17, 2023

🔗 CVE IDs covered (1)

CVE-2023-5550 →

📋 Description

In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user who also has direct access to the web server outside of the Moodle webroot could utilise a local file include to achieve remote code execution.

🎯 Affected products6

  • composer/moodle/moodle:>= 4.3.0-beta, < 4.3.0-rc2
  • composer/moodle/moodle:>= 4.2.0, < 4.2.3
  • composer/moodle/moodle:>= 4.1.0, < 4.1.6
  • composer/moodle/moodle:>= 4.0.0, < 4.0.11
  • composer/moodle/moodle:>= 3.10.0, < 3.11.17
  • composer/moodle/moodle:< 3.9.24

🔗 References (6)