Patchwire CVEs, their patch status, and feeds to follow them

CVE-2023-5550

Fixed upstream EPSS 2%CVSS 6.5

In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user who also has direct access to the web server outside of the Moodle webroot could utilise a local file include to achieve remote code execution.

Published 2023-11-09 · CVE record · OSV

Products: Moodle

Fixed upstream

EcosystemPackageFixed in
Packagistmoodle/moodle4.3.0-rc2
Packagistmoodle/moodle4.2.3
Packagistmoodle/moodle4.1.6
Packagistmoodle/moodle4.0.11
Packagistmoodle/moodle3.11.17
Packagistmoodle/moodle3.9.24

Distro releases

ReleasePackageFixed in
Ubuntu Pro 16.04 LTSmoodleno fix
Ubuntu Pro 18.04 LTSmoodleno fix