Moodle up to 4.2.2 resource injection

Summaryinfo

A vulnerability was found in Moodle up to 3.9.23/3.11.16/4.0.10/4.1.5/4.2.2. It has been classified as critical. The affected element is an unknown function. Performing a manipulation results in resource injection. This vulnerability is cataloged as CVE-2023-5544. It is possible to initiate the attack remotely. There is no exploit available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability classified as critical has been found in Moodle up to 3.9.23/3.11.16/4.0.10/4.1.5/4.2.2 (Learning Management Software). This affects an unknown code block. The manipulation with an unknown input leads to a resource injection vulnerability. CWE is classifying the issue as CWE-99. The product receives input from an upstream component, but it does not restrict or incorrectly restricts the input before it is used as an identifier for a resource that may be outside the intended sphere of control. The impact remains unknown.

The weakness was shared 10/19/2023. It is possible to read the advisory at bugzilla.redhat.com. This vulnerability is uniquely identified as CVE-2023-5544 since 10/12/2023. The technical details are unknown and an exploit is not publicly available. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 11/11/2023).

Upgrading to version 3.9.24, 3.11.17, 4.0.11, 4.1.6 or 4.2.3 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Learning Management Software

Name

• Moodle

Version

• 3.9.0
• 3.9.1
• 3.9.2
• 3.9.3
• 3.9.4
• 3.9.5
• 3.9.6
• 3.9.7
• 3.9.8
• 3.9.9
• 3.9.10
• 3.9.11
• 3.9.12
• 3.9.13
• 3.9.14
• 3.9.15
• 3.9.16
• 3.9.17
• 3.9.18
• 3.9.19
• 3.9.20
• 3.9.21
• 3.9.22
• 3.9.23
• 3.11.0
• 3.11.1
• 3.11.2
• 3.11.3
• 3.11.4
• 3.11.5
• 3.11.6
• 3.11.7
• 3.11.8
• 3.11.9
• 3.11.10
• 3.11.11
• 3.11.12
• 3.11.13
• 3.11.14
• 3.11.15
• 3.11.16
• 4.0.0
• 4.0.1
• 4.0.2
• 4.0.3
• 4.0.4
• 4.0.5
• 4.0.6
• 4.0.7
• 4.0.8
• 4.0.9
• 4.0.10
• 4.1.0
• 4.1.1
• 4.1.2
• 4.1.3
• 4.1.4
• 4.1.5
• 4.2.0
• 4.2.1
• 4.2.2

License

• open-source

Website

• Product: https://moodle.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion