← CVE Intelligence

CVE-2024-34002

moodle: authenticated LFI risk in some misconfigured shared hosting environments via modified mod_feedback backup PUBLISHED

Description (CNA)

In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user with both access to restore feedback modules and direct access to the web server outside of the Moodle webroot could execute a local file include.

Affected (CNA)

Vendor / productVersions
Not supplied / Not suppliedaffected 4.0 through 4.3.3; affected 4.2 through 4.2.6; affected 4.1 through 4.1.9

CWE

CWE-200

References

ADP enrichment

CVE

No English description supplied.

CISA-ADP

No English description supplied.

No references supplied.