CVE-2024-34005
Fixed upstream EPSS <1%CVSS 6.5
In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user with both access to restore database activity modules and direct access to the web server outside of the Moodle webroot could execute a local file include.
Products: Moodle
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Packagist | moodle/moodle | 4.3.4 |
| Packagist | moodle/moodle | 4.2.7 |
| Packagist | moodle/moodle | 4.1.10 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu:Pro:16.04:LTS | moodle | no fix |
| Ubuntu:Pro:18.04:LTS | moodle | no fix |