~ / search / GHSA-5cvx-cwpx-9rjh

GHSA-5cvx-cwpx-9rjh

Moodle Code Injection vulnerability

Source: GitHub Advisory Database (reviewed) Moderate CVE-2023-5550

Packages

EcosystemPackageAffectedFixed in
Packagist moodle/moodle >= 4.3.0-beta, < 4.3.0-rc2 4.3.0-rc2
Packagist moodle/moodle >= 4.2.0, < 4.2.3 4.2.3
Packagist moodle/moodle >= 4.1.0, < 4.1.6 4.1.6
Packagist moodle/moodle >= 4.0.0, < 4.0.11 4.0.11
Packagist moodle/moodle >= 3.10.0, < 3.11.17 3.11.17
Packagist moodle/moodle < 3.9.24 3.9.24

Details

As written in the advisory (Markdown source, shown as plain text).

In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user who also has direct access to the web server outside of the Moodle webroot could utilise a local file include to achieve remote code execution.

References

External links from the advisory. They lead to third-party sites.