GHSA-mm9p-xwfm-3fqfHighCVSS 6.5

Moodle Authenticated LFI risk in some misconfigured shared hosting environments

Published
May 31, 2024
Last Modified
October 31, 2024

🔗 CVE IDs covered (1)

CVE-2024-34002 →

📋 Description

In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user with both access to restore feedback modules and direct access to the web server outside of the Moodle webroot could execute a local file include.

🎯 Affected products3

  • composer/moodle/moodle:>= 4.3.0, < 4.3.4
  • composer/moodle/moodle:>= 4.2.0, < 4.2.7
  • composer/moodle/moodle:< 4.1.10

🔗 References (4)