CVE-2024-34002

CVE-2024-34002: moodle: authenticated LFI risk in some misconfigured shared hosting environments via modified mod_feedback backup

Weakness CWE-200 · Info exposure
Published May 31, 2024
Last update October 31, 2024

CVSS base score

What the vulnerability does

01Description

In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user with both access to restore feedback modules and direct access to the web server outside of the Moodle webroot could execute a local file include.

Key dates

02Disclosure timeline

May 31, 2024 CVE published
October 31, 2024 Record updated