CVE-2023-5540: Moodle Code Injection vulnerability
A remote code execution risk was identified in the IMSCP activity. By default this was only available to teachers and managers.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 4.3.0-rc2 - Upgrade
Upgrade
redhat/moodleto a version that resolves this vulnerability.Fixed in 4.2.3 - Upgrade
Upgrade
redhat/moodleto a version that resolves this vulnerability.Fixed in 4.1.6 - Upgrade
Upgrade
redhat/moodleto a version that resolves this vulnerability.Fixed in 4.0.11 - Upgrade
Upgrade
redhat/moodleto a version that resolves this vulnerability.Fixed in 3.11.17 - Upgrade
Upgrade
redhat/moodleto a version that resolves this vulnerability.Fixed in 3.9.24
Event History
Frequently Asked Questions
What is CVE-2023-5540?
CVE-2023-5540 is a vulnerability that allows for authenticated remote code execution in imscp.
Who is affected by CVE-2023-5540?
Users of Moodle versions 3.9.24 to 4.2.3 and Moodle/Moodle versions 3.9.24 to 4.3.0-rc2 are affected by CVE-2023-5540.
How severe is CVE-2023-5540?
CVE-2023-5540 has a severity rating of 8.8, which is classified as high.
How can I fix the CVE-2023-5540 vulnerability?
To fix CVE-2023-5540, you should update your Moodle installation to version 4.2.3 or higher.
Where can I find more information about CVE-2023-5540?
More information about CVE-2023-5540 can be found in the references section of the vulnerability report.