CVE-2023-23923: Moodle: possible to set the preferred "start page" of other users
Insufficient limitations on the "start page" preference made it possible to set that preference for another user. Note that this was still limited to the pre-defined start page options.
Versions affected: 4.1, 4.0 to 4.0.5, 3.11 to 3.11.11, 3.9 to 3.9.18 and earlier unsupported versions Versions fixed: 4.1.1, 4.0.6, 3.11.12 and 3.9.19
Other sources
The vulnerability was found Moodle which exists due to insufficient limitations on the "start page" preference. A remote attacker can set that preference for another user. The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2023-23923?
CVE-2023-23923 is a vulnerability found in Moodle that allows remote attackers to gain unauthorized access to restricted functionality.
How can a remote attacker exploit CVE-2023-23923?
A remote attacker can exploit CVE-2023-23923 by setting the 'start page' preference for another user.
Which versions of Moodle are affected by CVE-2023-23923?
Moodle versions 3.9.0 to 3.9.19, 3.11.0 to 3.11.12, and 4.0.0 to 4.0.6 are affected by CVE-2023-23923.
What is the severity rating of CVE-2023-23923?
CVE-2023-23923 has a severity rating of 8.2 (high).
How can I fix CVE-2023-23923?
To fix CVE-2023-23923, update Moodle to version 3.9.19, 3.11.12, or 4.0.6.