HIGH8.8
GHSA-w8x2-w4qr-v3x4
Moodle Code Injection vulnerability
Quick fix
GHSA-w8x2-w4qr-v3x4 — moodle/moodle: upgrade to the fixed version with the command below.
composer require moodle/moodle:^4.3.0-rc2Details
A remote code execution risk was identified in the IMSCP activity. By default this was only available to teachers and managers.
Are you affected?
Enter the version of the package you're using.
Affected packages
Packagist/moodle/moodle
Introduced in:
0Fixed in: 4.3.0-rc2Fix
composer require moodle/moodle:^4.3.0-rc2References
- https://nvd.nist.gov/vuln/detail/CVE-2023-5540[ADVISORY]
- https://github.com/moodle/moodle/commit/3400ae6510b11202aa9d86f7e75b3dff10d81522[WEB]
- https://bugzilla.redhat.com/show_bug.cgi?id=2243432[WEB]
- https://github.com/moodle/moodle[PACKAGE]
- https://moodle.org/mod/forum/discuss.php?d=451581[WEB]
- http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-79409[WEB]