6.5

CVE-2023-28330

Moodle: authenticated arbitrary file read through malformed backup file

Insufficient sanitizing in backup resulted in an arbitrary file read risk. The capability to access this feature is only available to teachers, managers and admins by default.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Moodle ≫ Moodle Version > 3.9.0 < 3.9.20
Moodle ≫ Moodle Version > 3.11.0 < 3.11.13
Moodle ≫ Moodle Version > 4.0.0 < 4.0.7
Moodle ≫ Moodle Version3.9.0 Update-
Moodle ≫ Moodle Version3.11.0 Update-
Moodle ≫ Moodle Version4.0.0 Update-
Moodle ≫ Moodle Version4.1.0 Update-
Moodle ≫ Moodle Version4.1.1
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.18% 0.637
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 6.5 2.8 3.6
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
134c704f-9b21-4f2e-91b3-4a467353bcc0 6.5 2.8 3.6
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3QZN34VSF4HTCW3C3ZP2OZYSLYUKADPF/
https://bugzilla.redhat.com/show_bug.cgi?id=2179412
https://moodle.org/mod/forum/discuss.php?d=445062
Patch
Vendor Advisory