Staging Environment: Content and features may be unstable or change without notice.
Advisory details: github_osv / GHSA-22gj-8qj2-fj46
Advisory ID github_osv/GHSA-22gj-8qj2-fj46
Aliases CVE-2023-30943
Summary Moodle External Control of File Name or Path vulnerability The vulnerability was found Moodle which exists because the application allows a user to control path of the older to create in TinyMCE loaders. A remote user can send a specially crafted HTTP request and create arbitrary folders on the system.
Status Published
Exploitability 0.5
Weighted Severity 4.8
Risk 2.4
Affected and Fixed Packages Package Details
Introduced and Fixed Package Commit Patches Package Commit Patches Details
Weaknesses (2)
CWE-73 External Control of File Name or Path
CWE-610 Externally Controlled Reference to a Resource in Another Sphere
System Score Found at
cvssv3.1 5.3 https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/05/GHSA-22gj-8qj2-fj46/GHSA-22gj-8qj2-fj46.json
generic_textual MODERATE
Reference id Reference type URL
http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-77718
https://bugzilla.redhat.com/show_bug.cgi?id=2188605
https://github.com/moodle/moodle
https://github.com/moodle/moodle/commit/59d42e1ed23f916dcb47d53c745bef18a116d800
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/54TM5H5PDUDYXOQ7X7PPYWP4AJDAE73I
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MZBWRVUJF7HI53XCJPJ3YJZPOV5HBRUY
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PBFSXRYLT4ICKJVQSRBAOUDMDRVSVBLS
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/54TM5H5PDUDYXOQ7X7PPYWP4AJDAE73I
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MZBWRVUJF7HI53XCJPJ3YJZPOV5HBRUY
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PBFSXRYLT4ICKJVQSRBAOUDMDRVSVBLS
https://moodle.org/mod/forum/discuss.php?d=446285
CVE-2023-30943 https://nvd.nist.gov/vuln/detail/CVE-2023-30943
No exploits are available.

No EPSS data available for this advisory.

Patch URL
There are no known patches.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Found at https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/05/GHSA-22gj-8qj2-fj46/GHSA-22gj-8qj2-fj46.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none

There are no SSVC decisions available.