Rce due to lfi risk in some misconfigured shared hosting environments
CVE-2023-5550

9.8CRITICAL

Key Information:

Vendor

Fedora

Status
moodle
Extra Packages for Enterprise Linux 7
Fedora
Vendor
CVE Published:
9 November 2023

What is CVE-2023-5550?

In a misconfigured shared hosting environment, Moodle users with direct access to the web server outside of the Moodle webroot can exploit a local file inclusion vulnerability. This allows them to access sensitive content from other users and potentially execute arbitrary code remotely. Proper configuration is essential to prevent unauthorized access and mitigate the risk associated with this vulnerability.

Affected Version(s)

moodle 4.2.3

moodle 4.1.6

moodle 4.0.11

References

http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=...
https://bugzilla.redhat.com/show_bug.cgi?id=2243452
issue-trackingx_refsource_REDHAT
https://moodle.org/mod/forum/discuss.php?d=451591

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2023-5550 : Rce due to lfi risk in some misconfigured shared hosting environments