Lookup for vulnerabilities affecting packages.
| Vulnerability_id | VCID-zd4r-bn1p-27a5 |
|---|
| Summary | Moodle has a Remote Code Execution risk via file restore
A flaw was identified in Moodle’s backup restore functionality where specially crafted backup files were not properly validated during processing. If a malicious backup file is restored, it could lead to unintended execution of server-side code. Since restore capabilities are typically available to privileged users, exploitation requires authenticated access. Successful exploitation could result in full compromise of the Moodle server. |
|---|
| Aliases |
| 0 |
|
| 1 |
| alias |
GHSA-ggxq-2mg9-8966 |
|
|
|---|
| Fixed_packages |
|
|---|
| Affected_packages |
| 0 |
| url |
pkg:composer/moodle/moodle@5.0.0-beta |
| purl |
pkg:composer/moodle/moodle@5.0.0-beta |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-2h6c-6mgm-akc2 |
|
| 1 |
| vulnerability |
VCID-4uwn-m5xb-8ufn |
|
| 2 |
| vulnerability |
VCID-7z2w-xpn7-gbhm |
|
| 3 |
| vulnerability |
VCID-a6w6-penj-kuds |
|
| 4 |
| vulnerability |
VCID-aac8-q8g6-ebfw |
|
| 5 |
| vulnerability |
VCID-cghw-xbkf-juh9 |
|
| 6 |
| vulnerability |
VCID-de7j-3de2-s3ee |
|
| 7 |
| vulnerability |
VCID-eutz-ecg4-b3he |
|
| 8 |
| vulnerability |
VCID-evtb-ua7c-3fed |
|
| 9 |
| vulnerability |
VCID-ewey-azre-s3fh |
|
| 10 |
| vulnerability |
VCID-fcf4-tf5h-hfcr |
|
| 11 |
| vulnerability |
VCID-jcxv-jtyh-f7e9 |
|
| 12 |
| vulnerability |
VCID-k45j-wnny-nfa2 |
|
| 13 |
| vulnerability |
VCID-qnbd-sejn-pfgp |
|
| 14 |
| vulnerability |
VCID-smgv-8j8r-1ba9 |
|
| 15 |
| vulnerability |
VCID-xxtt-z6tn-mqc5 |
|
| 16 |
| vulnerability |
VCID-ysax-7hvs-mkct |
|
| 17 |
| vulnerability |
VCID-zaff-9ezm-aba1 |
|
| 18 |
| vulnerability |
VCID-zd4r-bn1p-27a5 |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:composer/moodle/moodle@5.0.0-beta |
|
| 1 |
|
|
|---|
| References |
|
|---|
| Weaknesses |
| 0 |
| cwe_id |
94 |
| name |
Improper Control of Generation of Code ('Code Injection') |
| description |
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. |
|
| 1 |
| cwe_id |
937 |
| name |
OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities |
| description |
Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013. |
|
| 2 |
| cwe_id |
1035 |
| name |
OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities |
| description |
Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017. |
|
|
|---|
| Exploits |
|
|---|
| Severity_range_score | 7.0 - 8.9 |
|---|
| Exploitability | 0.5 |
|---|
| Weighted_severity | 8.0 |
|---|
| Risk_score | 4.0 |
|---|
| Resource_url | http://public2.vulnerablecode.io/vulnerabilities/VCID-zd4r-bn1p-27a5 |
|---|