CVE-2024-34003
Fixed upstream EPSS <1%CVSS 5.9
In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user with both access to restore workshop modules and direct access to the web server outside of the Moodle webroot could execute a local file include.
Products: Moodle
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Packagist | moodle/moodle | 4.3.4 |
| Packagist | moodle/moodle | 4.2.7 |
| Packagist | moodle/moodle | 4.1.10 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu Pro 16.04 LTS | moodle | no fix |
| Ubuntu Pro 18.04 LTS | moodle | no fix |