CVE-2024-34005

In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user with both access to restore database activity modules and direct access to the web server outside of the Moodle webroot could execute a local file include.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://moodle.org/mod/forum/discuss.php?d=458394	Vendor Advisory
https://moodle.org/mod/forum/discuss.php?d=458394	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:moodle:moodle::::::::
	cpe:2.3:a:moodle:moodle::::::::
	cpe:2.3:a:moodle:moodle::::::::

History

01 May 2025, 15:43

Type	Values Removed	Values Added
CPE		cpe:2.3:a:moodle:moodle::::::::
First Time		Moodle Moodle moodle
CWE		NVD-CWE-noinfo
References	~~() https://moodle.org/mod/forum/discuss.php?d=458394 -~~	() https://moodle.org/mod/forum/discuss.php?d=458394 - Vendor Advisory

Information

Published : 2024-05-31 21:15

Updated : 2025-05-01 15:43

NVD link : CVE-2024-34005

Mitre link : CVE-2024-34005

CVE.ORG link : CVE-2024-34005

JSON object : View

Products Affected

moodle

moodle

CWE

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

NVD-CWE-noinfo

{"id": "CVE-2024-34005", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2024-05-31T21:15:09.440", "references": [{"url": "https://moodle.org/mod/forum/discuss.php?d=458394", "tags": ["Vendor Advisory"], "source": "patrick@puiterwijk.org"}, {"url": "https://moodle.org/mod/forum/discuss.php?d=458394", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "patrick@puiterwijk.org", "description": [{"lang": "en", "value": "CWE-200"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user with both access to restore database activity modules and direct access to the web server outside of the Moodle webroot could execute a local file include."}, {"lang": "es", "value": "En un entorno de alojamiento compartido que ha sido mal configurado para permitir el acceso al contenido de otros usuarios, un usuario de Moodle con acceso para restaurar los m\u00f3dulos de actividad de la base de datos y acceso directo al servidor web fuera de la ra\u00edz web de Moodle podr\u00eda ejecutar una inclusi\u00f3n de archivo local."}], "lastModified": "2025-05-01T15:43:22.187", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "181FEE3D-2D75-4269-A095-C555B313E159", "versionEndExcluding": "4.1.10"}, {"criteria": "cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B3309504-72F2-4154-AF1C-57797BFEA31B", "versionEndExcluding": "4.2.7", "versionStartIncluding": "4.2.0"}, {"criteria": "cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BE7100F0-5F88-497E-A04D-071DFEE765C6", "versionEndExcluding": "4.3.4", "versionStartIncluding": "4.3.0"}], "operator": "OR"}]}], "sourceIdentifier": "patrick@puiterwijk.org"}