CVE-2023-28330

MEDIUM

moodle 3.9.0-3.9.19 and 4.1.0-4.1.1 - Authenticated Arbitrary File Read via Backup Feature

Title source: llm

Description

Insufficient sanitizing in backup resulted in an arbitrary file read risk. The capability to access this feature is only available to teachers, managers and admins by default.

References (3)

Core 3

Core References

Patch, Vendor Advisory

https://moodle.org/mod/forum/discuss.php?d=445062

Issue Tracking issue-tracking x_refsource_redhat

https://bugzilla.redhat.com/show_bug.cgi?id=2179412

Mailing List, Third Party Advisory vendor-advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3QZN34VSF4HTCW3C3ZP2OZYSLYUKADPF/

Scores

CVSS v3 6.5

EPSS 0.0105

EPSS Percentile 78.0%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-20

Status published

Products (7)

moodle/moodle 3.9.0

moodle/moodle 3.11.0

moodle/moodle 4.0.0

moodle/moodle 4.1.0

moodle/moodle 4.1.1

moodle/moodle 3.9.0 - 3.9.20

moodle/moodle 4.1.0 - 4.1.2Packagist

Published Mar 23, 2023

Tracked Since Feb 18, 2026