CVE-2023-28330: Moodle arbitrary file read vulnerability
Insufficient sanitizing in backup resulted in an arbitrary file read risk. The capability to access this feature is only available to teachers, managers and admins by default.
Other sources
Moodle arbitrary file read vulnerability
— Packagist
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/moodleto a version that resolves this vulnerability.Fixed in 4.1.2 - Upgrade
Upgrade
redhat/moodleto a version that resolves this vulnerability.Fixed in 4.0.7 - Upgrade
Upgrade
redhat/moodleto a version that resolves this vulnerability.Fixed in 3.11.13 - Upgrade
Upgrade
redhat/moodleto a version that resolves this vulnerability.Fixed in 3.9.20 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 3.9.20 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 3.11.13 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 4.0.7 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 4.1.2
Event History
Frequently Asked Questions
What is CVE-2023-28330?
CVE-2023-28330 is a vulnerability in Moodle, which allows teachers, managers, and admins to read arbitrary files through a backup feature.
Who is affected by CVE-2023-28330?
Moodle versions 3.9.0 to 3.9.20, 3.11.0 to 3.11.13, 4.0.0 to 4.0.7, 4.1.0, and 4.1.1 are affected by CVE-2023-28330.
What is the severity of CVE-2023-28330?
CVE-2023-28330 has a severity score of 6.5, which is considered a medium severity vulnerability.
How can I fix CVE-2023-28330?
To fix CVE-2023-28330, users should update their Moodle installation to a version that is not affected by the vulnerability.
Where can I find more information about CVE-2023-28330?
More information about CVE-2023-28330 can be found in the references provided: [Reference 1](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3QZN34VSF4HTCW3C3ZP2OZYSLYUKADPF/) and [Reference 2](https://moodle.org/mod/forum/discuss.php?d=445062).