CVE-2023-30944: Moodle: minor sql injection risk in external wiki method for listing pages
A limited SQL injection risk was identified in functionality used by the Wiki activity when listing pages.
Versions affected: 4.1 to 4.1.2, 4.0 to 4.0.7, 3.11 to 3.11.13, 3.9 to 3.9.20 and earlier unsupported versions Versions fixed: 4.1.3, 4.0.8, 3.11.14 and 3.9.21
Other sources
The vulnerability was found Moodle which exists due to insufficient sanitization of user-supplied data in external Wiki method for listing pages. A remote attacker can send a specially crafted request to the affected application and execute limited SQL commands within the application database.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the vulnerability ID for this Moodle vulnerability?
The vulnerability ID for this Moodle vulnerability is CVE-2023-30944.
What is the severity of CVE-2023-30944?
CVE-2023-30944 has a severity of 7.3 (high).
Which software versions are affected by CVE-2023-30944?
The affected software versions for CVE-2023-30944 are Moodle 3.9.0 to 3.9.21, Moodle 3.11.0 to 3.11.14, Moodle 4.0.0 to 4.0.8, Moodle 4.1.0 to 4.1.3, and Fedora Extra Packages For Enterprise Linux 7.0, Fedora 36, Fedora 37, Fedora 38.
How can a remote attacker exploit CVE-2023-30944?
A remote attacker can exploit CVE-2023-30944 by sending a specially crafted request to the affected application and execute limited SQL commands within the application database.
Are there any fixes or patches available for CVE-2023-30944?
Yes, fixes or patches are available for CVE-2023-30944. It is advised to update to Moodle 3.9.22, Moodle 3.11.15, Moodle 4.0.9, Moodle 4.1.4, or later versions.