CVE-2023-30944
MEDIUMMoodle 3.9.0-3.9.20 and <4.2.0-rc2 - SQL Injection via External Wiki Page Listing
Title source: llmDescription
The vulnerability was found Moodle which exists due to insufficient sanitization of user-supplied data in external Wiki method for listing pages. A remote attacker can send a specially crafted request to the affected application and execute limited SQL commands within the application database.
References (6)
Core 6
Core References
Issue Tracking, Patch, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2188606
Patch, Vendor Advisory
https://moodle.org/mod/forum/discuss.php?d=446286
Mailing List, Third Party Advisory vendor-advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/54TM5H5PDUDYXOQ7X7PPYWP4AJDAE73I/
Mailing List, Third Party Advisory vendor-advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MZBWRVUJF7HI53XCJPJ3YJZPOV5HBRUY/
Mailing List, Third Party Advisory vendor-advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PBFSXRYLT4ICKJVQSRBAOUDMDRVSVBLS/
Scores
CVSS v3
5.6
EPSS
0.0108
EPSS Percentile
78.1%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
partial
Details
CWE
CWE-89
Status
published
Products (6)
fedoraproject/extra_packages_for_enterprise_linux
7.0
fedoraproject/fedora
36
fedoraproject/fedora
37
fedoraproject/fedora
38
moodle/moodle
0 - 4.2.0-rc2Packagist
moodle/moodle
3.9.0 - 3.9.21
Published
May 02, 2023
Tracked Since
Feb 18, 2026