Moole Vulnerability Database

Find real vulnerabilities before they ship

Medium

CVE-2023-28330

Insufficient sanitizing in backup resulted in an arbitrary file read risk. The capability to access this feature is only available to teachers, managers and admins by default.

VectorNETWORK

PublishedMar 23, 2023, 21:15

Published Bypatrick@puiterwijk.org

Base Score

Score6.5

Affected Versions

Package (Ecosystem)IntroducedFixedLimit

moodle/moodle(Packagist)4.1.04.1.2N/A

moodle/moodle(Packagist)4.0.04.0.7N/A

moodle/moodle(Packagist)3.11.03.11.13N/A

moodle/moodle(Packagist)03.9.20N/A

References

https://bugzilla.redhat.com/show_bug.cgi?id=2179412
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3QZN34VSF4HTCW3C3ZP2OZYSLYUKADPF/
https://moodle.org/mod/forum/discuss.php?d=445062

Weakness Type

NVD-CWE-noinfo

CVSS Metrics

Base Score

6.5

Vector String

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Base SeverityMedium

Version

3.1

Attack Vector (AV)

NETWORK