~ / search / GHSA-56r9-72vx-q989

GHSA-56r9-72vx-q989

Moodle arbitrary file read vulnerability

Source: GitHub Advisory Database (reviewed) Moderate CVE-2023-28330

Packages

EcosystemPackageAffectedFixed in
Packagist moodle/moodle >= 4.1.0, < 4.1.2 4.1.2
Packagist moodle/moodle >= 4.0.0, < 4.0.7 4.0.7
Packagist moodle/moodle >= 3.11.0, < 3.11.13 3.11.13
Packagist moodle/moodle < 3.9.20 3.9.20

Details

As written in the advisory (Markdown source, shown as plain text).

Insufficient sanitizing in backup resulted in an arbitrary file read risk. The capability to access this feature is only available to teachers, managers and admins by default.

References

External links from the advisory. They lead to third-party sites.