CVE-2024-34003:
Moodle Authenticated LFI risk in some misconfigured shared hosting environments
5.9
CVSS Score
3.1
Basic Information
CVE ID
GHSA ID
EPSS Score
0.3851%
CWE
Published
5/31/2024
Updated
7/5/2024
KEV Status
No
Technology
PHP
Technical Details
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
---|---|---|---|
moodle/moodle | composer | >= 4.3.0, < 4.3.4 | 4.3.4 |
moodle/moodle | composer | >= 4.2.0, < 4.2.7 | 4.2.7 |
moodle/moodle | composer | < 4.1.10 | 4.1.10 |
Vulnerability Intelligence
Miggo AI
Root Cause Analysis
The vulnerability manifests in workshop module restoration functionality. While exact code changes aren't available, the advisory references MDL-80712
and affects workshop backup handling. The restoration process
would logically involve file inclusion mechanisms that could be vulnerable to path traversal if not properly sanitized. The medium confidence reflects the lack of direct commit analysis, but the context strongly implicates workshop restoration workflow components.