CVE-2022-40314: Remote Code Execution Risk in Moodle
Summary
CVE-2022-40314: A remote code execution risk when restoring backup files originating from Moodle 1.9 was identified. Affects moodle across 3 version ranges.
>= 3.9.0, < 3.9.17
>= 3.11.0, < 3.11.10
>= 4.0.0, < 4.0.4
Fixed in 3.9.17, 3.11.10 or 4.0.4, depending on the release line you run. How to fix ↓
Also tracked for
- moodle/moodle · Packagist
The same CVE-2022-40314 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning management system widely used for creating online educational platforms. It provides various features for course management, content creation, and collaboration among students and teachers. Moodle is vulnerable to a remote code execution risk when restoring backup files originating from Moodle 1.9.
Vulnerability Detail
The identified vulnerability in Moodle allows an attacker to execute arbitrary code remotely. This vulnerability specifically affects backup files from Moodle 1.9. If an attacker can upload a malicious backup file and restore it on a vulnerable Moodle instance, they can execute arbitrary code with the privileges of the Moodle application. This can lead to unauthorized access, data breaches, and potential compromise of the entire Moodle system.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 3.9.0, < 3.9.173.9.17 -
>= 3.11.0, < 3.11.103.11.10 -
>= 4.0.0, < 4.0.44.0.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a workaround, it is advised to avoid restoring backup files originating from Moodle 1.9 on vulnerable Moodle instances. If necessary, thoroughly scan and validate the backup files for any potential malicious code before restoring them.
Conclusion
The identified vulnerability in Moodle poses a critical risk of remote code execution. It is crucial to update Moodle to the recommended versions to mitigate this risk. Additionally, exercising caution when restoring backup files and validating their integrity can help prevent exploitation. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for moodle →
FAQ
Moodle is an open-source learning management system used for creating online educational platforms.
The vulnerability allows remote code execution, potentially leading to unauthorized access, data breaches, and compromise of the Moodle system.
Moodle versions 3.9.0 to 3.9.17, 3.11.0 to 3.11.10, and 4.0.0 to 4.0.4 are affected.
Update Moodle to versions 3.9.17, 3.11.10, or 4.0.4 to fix this vulnerability.
Avoid restoring backup files from Moodle 1.9 on vulnerable Moodle instances. Validate backup files for potential malicious code before restoring.
Related vulnerabilities
Recent vulnerabilities recorded for moodle.
