Описание
Moodle Code Injection vulnerability
In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user who also has direct access to the web server outside of the Moodle webroot could utilise a local file include to achieve remote code execution.
Ссылки
- https://nvd.nist.gov/vuln/detail/CVE-2023-5550
- https://github.com/moodle/moodle/commit/77766f9c8af8fc8d861d7ac09ce4e1f6e72faca7
- https://bugzilla.redhat.com/show_bug.cgi?id=2243452
- https://moodle.org/mod/forum/discuss.php?d=451591
- http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-72249
Пакеты
moodle/moodle
>= 4.3.0-beta, < 4.3.0-rc2
4.3.0-rc2
moodle/moodle
>= 4.2.0, < 4.2.3
4.2.3
moodle/moodle
>= 4.1.0, < 4.1.6
4.1.6
moodle/moodle
>= 4.0.0, < 4.0.11
4.0.11
moodle/moodle
>= 3.10.0, < 3.11.17
3.11.17
moodle/moodle
< 3.9.24
3.9.24
Связанные уязвимости
In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user who also has direct access to the web server outside of the Moodle webroot could utilise a local file include to achieve remote code execution.
In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user who also has direct access to the web server outside of the Moodle webroot could utilise a local file include to achieve remote code execution.
In a shared hosting environment that has been misconfigured to allow a ...
Уязвимость виртуальной обучающей среды Moodle, связанная с неверным управлением генерацией кода, позволяющая нарушителю выполнить произвольный код
