CVE-2024-34003: Moodle Local File Inclusion Vulnerability in Misconfigured Shared Hosting Environments
Summary
CVE-2024-34003: In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user with both access to restore workshop modules and direct access to the web server outside of the Moodle we... Affects moodle across 3 version ranges.
< 4.1.10
>= 4.2.0, < 4.2.7
>= 4.3.0, < 4.3.4
Fixed in 4.1.10, 4.2.7 or 4.3.4, depending on the release line you run. How to fix ↓
Also tracked for
- moodle/moodle · Packagist
The same CVE-2024-34003 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning platform designed to provide educators, administrators, and learners with a single robust, secure, and integrated system to create personalized learning environments. It is widely used in educational institutions and organizations for online learning and course management. However, in certain misconfigured shared hosting environments, Moodle can be vulnerable to local file inclusion attacks, particularly when users have access to restore workshop modules and direct access to the web server outside of the Moodle webroot.
Vulnerability Detail
The vulnerability arises from improper configuration in shared hosting environments that allow users to access content belonging to other users. A Moodle user with the ability to restore workshop modules can exploit this misconfiguration to execute a local file inclusion attack. This could lead to unauthorized access to sensitive files on the server, potentially exposing confidential information and compromising the integrity of the application.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 4.1.104.1.10 -
>= 4.2.0, < 4.2.74.2.7 -
>= 4.3.0, < 4.3.44.3.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If immediate patching is not feasible, consider restricting access to the web server for users who can restore workshop modules. This can be done by adjusting file permissions and ensuring that users do not have access to directories outside of their own content.
Conclusion
CVE-2024-34003 presents a significant risk for Moodle installations in misconfigured shared hosting environments. It is crucial to update to the latest patched versions to mitigate this vulnerability and protect sensitive information. Additionally, implementing proper access controls can serve as a temporary workaround until the update is applied.
See every vulnerability recorded for moodle →
FAQ
CVE-2024-34003 is a vulnerability in Moodle that allows local file inclusion in misconfigured shared hosting environments.
You can check your Moodle version against the patched versions (4.1.10, 4.2.7, 4.3.4 or later) or use Vulert's playground to monitor for vulnerabilities.
The risks include unauthorized access to sensitive files and potential compromise of the Moodle application, leading to data breaches.
Follow the steps outlined in the 'how_to_fix' section to safely update your Moodle installation to a patched version.
Vulert monitors and alerts for open-source vulnerabilities in software using a manifest file. You can check if your application is affected by vulnerabilities like CVE-2024-34003 without any signup.
References
Related vulnerabilities
Recent vulnerabilities recorded for moodle.
