CVE-2023-28330: Moodle: authenticated arbitrary file read through malformed backup file
Insufficient sanitizing in backup resulted in an arbitrary file read risk. The capability to access this feature is only available to teachers, managers and admins by default.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2023-28330?
CVE-2023-28330 is a vulnerability in Moodle, which allows teachers, managers, and admins to read arbitrary files through a backup feature.
Who is affected by CVE-2023-28330?
Moodle versions 3.9.0 to 3.9.20, 3.11.0 to 3.11.13, 4.0.0 to 4.0.7, 4.1.0, and 4.1.1 are affected by CVE-2023-28330.
What is the severity of CVE-2023-28330?
CVE-2023-28330 has a severity score of 6.5, which is considered a medium severity vulnerability.
How can I fix CVE-2023-28330?
To fix CVE-2023-28330, users should update their Moodle installation to a version that is not affected by the vulnerability.
Where can I find more information about CVE-2023-28330?
More information about CVE-2023-28330 can be found in the references provided: [Reference 1](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3QZN34VSF4HTCW3C3ZP2OZYSLYUKADPF/) and [Reference 2](https://moodle.org/mod/forum/discuss.php?d=445062).