CVE-2024-34002: Moodle Authenticated LFI risk in some misconfigured shared hosting environments

May 31, 2024 (updated October 31, 2024)

In a shared hosting environment that has been misconfigured to allow access to other users’ content, a Moodle user with both access to restore feedback modules and direct access to the web server outside of the Moodle webroot could execute a local file include.

References

github.com/advisories/GHSA-mm9p-xwfm-3fqf
github.com/moodle/moodle
moodle.org/mod/forum/discuss.php?d=458390
nvd.nist.gov/vuln/detail/CVE-2024-34002

Code Behaviors & Features

Detect and mitigate CVE-2024-34002 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →