CVE-2024-34005: Moodle Local File Inclusion Vulnerability in Misconfigured Shared Hosting Environments
Summary
CVE-2024-34005: In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user with both access to restore database activity modules and direct access to the web server outside of the... Affects moodle across 3 version ranges.
< 4.1.10
>= 4.2.0, < 4.2.7
>= 4.3.0, < 4.3.4
Fixed in 4.1.10, 4.2.7 or 4.3.4, depending on the release line you run. How to fix ↓
Also tracked for
- moodle/moodle · Packagist
The same CVE-2024-34005 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is a widely-used open-source learning platform designed to provide educators, administrators, and learners with a single robust, secure, and integrated system to create personalized learning environments. It supports various educational activities and is highly customizable. However, in certain misconfigured shared hosting environments, Moodle can be vulnerable to local file inclusion attacks, allowing unauthorized access to sensitive content.
Vulnerability Detail
In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user with access to restore database activity modules and direct access to the web server outside of the Moodle webroot could execute a local file include. This vulnerability arises from improper access controls and can lead to unauthorized data exposure, potentially compromising user privacy and system integrity.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 4.1.104.1.10 -
>= 4.2.0, < 4.2.74.2.7 -
>= 4.3.0, < 4.3.44.3.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, ensure that your shared hosting environment is configured to restrict access to users' content. This may involve adjusting file permissions and access controls to prevent unauthorized users from accessing sensitive directories.
Conclusion
CVE-2024-34005 represents a significant risk for Moodle users in misconfigured shared hosting environments. It is crucial to update to the latest patched versions and ensure proper configuration to mitigate this vulnerability effectively.
See every vulnerability recorded for moodle →
FAQ
CVE-2024-34005 is a vulnerability in Moodle that allows local file inclusion in misconfigured shared hosting environments.
Users of Moodle installed in shared hosting environments that are misconfigured to allow access to other users' content are at risk.
If exploited, this vulnerability can lead to unauthorized access to sensitive data, potentially compromising user privacy and system integrity.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If you cannot update Moodle immediately, ensure that your hosting environment is properly configured to restrict access to sensitive content as a temporary measure.
References
Related vulnerabilities
Recent vulnerabilities recorded for moodle.
