by Kastro CVE-2023-5550
moodle moodle — Moodle: rce due to lfi risk in some misconfigured shared hosting environments
Description · from the CVE record
In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user who also has direct access to the web server outside of the Moodle webroot could utilise a local file include to achieve remote code execution.
Affected
ProductAffectedFixed inSource
moodle4.2.0 – < 4.2.34.2.3CNA
moodle4.1.0 – < 4.1.64.1.6CNA
moodle4.0.0 – < 4.0.114.0.11CNA
moodle3.11.0 – < 3.11.173.11.17CNA
moodle< 3.9.243.9.24CNA
moodle4.2.0 – < 4.2.34.2.3CISA-ADP
moodle4.1.0 – < 4.1.64.1.6CISA-ADP
moodle4.0.0 – < 4.0.114.0.11CISA-ADP
moodle3.11.0 – < 3.11.173.11.17CISA-ADP
moodle< 3.9.243.9.24CISA-ADP
Scores by source
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
fedora (CNA)6.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial