Moodle up to 4.2.2 file inclusion

Summaryinfo

A vulnerability described as critical has been identified in Moodle up to 3.9.23/3.11.16/4.0.10/4.1.5/4.2.2. Affected is an unknown function. Such manipulation leads to file inclusion. This vulnerability is uniquely identified as CVE-2023-5550. The attack can be launched remotely. No exploit exists. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability, which was classified as critical, has been found in Moodle up to 3.9.23/3.11.16/4.0.10/4.1.5/4.2.2 (Learning Management Software). Affected by this issue is an unknown code block. The manipulation with an unknown input leads to a file inclusion vulnerability. Using CWE to declare the problem leads to CWE-73. The product allows user input to control or influence paths or file names that are used in filesystem operations. Impacted is confidentiality, integrity, and availability.

The weakness was disclosed 10/19/2023. The advisory is shared for download at bugzilla.redhat.com. This vulnerability is handled as CVE-2023-5550 since 10/12/2023. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 11/11/2023).

Upgrading to version 3.9.24, 3.11.17, 4.0.11, 4.1.6 or 4.2.3 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Learning Management Software

Name

• Moodle

Version

• 3.9.0
• 3.9.1
• 3.9.2
• 3.9.3
• 3.9.4
• 3.9.5
• 3.9.6
• 3.9.7
• 3.9.8
• 3.9.9
• 3.9.10
• 3.9.11
• 3.9.12
• 3.9.13
• 3.9.14
• 3.9.15
• 3.9.16
• 3.9.17
• 3.9.18
• 3.9.19
• 3.9.20
• 3.9.21
• 3.9.22
• 3.9.23
• 3.11.0
• 3.11.1
• 3.11.2
• 3.11.3
• 3.11.4
• 3.11.5
• 3.11.6
• 3.11.7
• 3.11.8
• 3.11.9
• 3.11.10
• 3.11.11
• 3.11.12
• 3.11.13
• 3.11.14
• 3.11.15
• 3.11.16
• 4.0.0
• 4.0.1
• 4.0.2
• 4.0.3
• 4.0.4
• 4.0.5
• 4.0.6
• 4.0.7
• 4.0.8
• 4.0.9
• 4.0.10
• 4.1.0
• 4.1.1
• 4.1.2
• 4.1.3
• 4.1.4
• 4.1.5
• 4.2.0
• 4.2.1
• 4.2.2

License

• open-source

Website

• Product: https://moodle.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion