Moodle Code Injection vulnerability
Moderate severity
GitHub Reviewed
Published
Nov 9, 2023
to the GitHub Advisory Database
•
Updated Nov 17, 2023
Package
Affected versions
>= 4.3.0-beta, < 4.3.0-rc2
>= 4.2.0, < 4.2.3
>= 4.1.0, < 4.1.6
>= 4.0.0, < 4.0.11
>= 3.10.0, < 3.11.17
< 3.9.24
Patched versions
4.3.0-rc2
4.2.3
4.1.6
4.0.11
3.11.17
3.9.24
Description
Published by the National Vulnerability Database
Nov 9, 2023
Published to the GitHub Advisory Database
Nov 9, 2023
Reviewed
Nov 10, 2023
Last updated
Nov 17, 2023
In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user who also has direct access to the web server outside of the Moodle webroot could utilise a local file include to achieve remote code execution.
References