| Package | Affected versions | Patched versions |
|---|---|---|
| moodle/moodle | ≥ 3.10.0, < 3.11.17≥ 4.0.0, < 4.0.11≥ 4.1.0, < 4.1.6≥ 4.2.0, < 4.2.3≥ 4.3.0-beta, < 4.3.0-rc2< 3.9.24 | 3.11.174.0.114.1.64.2.34.3.0-rc23.9.24 |
| extra packages for enterprise linux | = 7.0 | |
| moodle | ≥ 3.11.0, < 3.11.17≥ 4.0.0, < 4.0.11≥ 4.1.0, < 4.1.6≥ 4.2.0, < 4.2.3< 3.9.24 | 3.11.174.0.114.1.64.2.33.9.24 |
In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user who also has direct access to the web server outside of the Moodle webroot could utilise a local file include to achieve remote code execution.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free