GitHub Advisoryadvisory · Packagist

GHSA-56r9-72vx-q989 Moodle arbitrary file read vulnerability

MEDIUM Published 2023-03-23 Modified 2024-04-19 Official page ↗
Aliases
CVE-2023-28330
Ecosystem
Packagist
Packages
moodle/moodle
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-20
Reviewed
2023-03-23

Affected packages

• Packagist moodle/moodle: >= 4.1.0, < 4.1.2 → fixed in 4.1.2 • Packagist moodle/moodle: >= 4.0.0, < 4.0.7 → fixed in 4.0.7 • Packagist moodle/moodle: >= 3.11.0, < 3.11.13 → fixed in 3.11.13 • Packagist moodle/moodle: < 3.9.20 → fixed in 3.9.20

Description

Insufficient sanitizing in backup resulted in an arbitrary file read risk. The capability to access this feature is only available to teachers, managers and admins by default.

Related

Alias · CVE (1)

  • CVE-2023-28330 Insufficient sanitizing in backup resulted in an arbitrary file read risk. vulnerability

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References