CVE-2023-30943: Moodle: tinymce loaders susceptible to arbitrary folder creation
Insufficient sanitizing of loaders used by TinyMCE resulted in an arbitrary folder creation risk.
Versions affected: 4.1 to 4.1.2 Versions fixed: 4.1.3
Other sources
The vulnerability was found Moodle which exists because the application allows a user to control path of the older to create in TinyMCE loaders. A remote user can send a specially crafted HTTP request and create arbitrary folders on the system.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the vulnerability ID for this Moodle vulnerability?
The vulnerability ID for this Moodle vulnerability is CVE-2023-30943.
What is the severity of CVE-2023-30943?
The severity of CVE-2023-30943 is medium with a severity value of 5.3.
How does CVE-2023-30943 affect Moodle?
CVE-2023-30943 affects Moodle by allowing a user to control the path of file creation in TinyMCE loaders.
How can a remote user exploit CVE-2023-30943?
A remote user can exploit CVE-2023-30943 by sending a specially crafted HTTP request to create arbitrary folders on the system.
What is the recommended remedy for CVE-2023-30943?
The recommended remedy for CVE-2023-30943 is to update to Moodle version 4.1.3.