CVE-2023-30943

MEDIUM5.3EPSS 26.5%

Moodle External Control of File Name or Path vulnerability

Published: 5/2/2023Modified: 4/19/2024
Also known as:GHSA-22gj-8qj2-fj46BIT-moodle-2023-30943

Description

The vulnerability was found Moodle which exists because the application allows a user to control path of the older to create in TinyMCE loaders. A remote user can send a specially crafted HTTP request and create arbitrary folders on the system.

Affected packages (2)

CVSS scores

SourceVersionSeverityVector
osvCVSS 3.1MEDIUM5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

References (15)