CVE-2024-43440 - OpenCVE

A flaw was found in moodle. A local file may include risks when restoring block backups.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact partial

Vendors	Products
Moodle	Moodle

No data.

No data.

References

Link	Providers
https://bugzilla.redhat.com/show_bug.cgi?id=2304269
https://moodle.org/mod/forum/discuss.php?d=461210
https://nvd.nist.gov/vuln/detail/CVE-2024-43440
https://www.cve.org/CVERecord?id=CVE-2024-43440

History

Thu, 07 Nov 2024 15:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Moodle Moodle moodle
Weaknesses		CWE-22
CPEs		cpe:2.3:a:moodle:moodle::::::::
Vendors & Products		Moodle Moodle moodle
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Thu, 07 Nov 2024 13:45:00 +0000

Type	Values Removed	Values Added
Title	moodle: LFI vulnerability when restoring malformed block backups	Moodle: lfi vulnerability when restoring malformed block backups
References		https://bugzilla.redhat.com/show_bug.cgi?id=2304269

Sat, 31 Aug 2024 02:30:00 +0000

Type	Values Removed	Values Added
Description	No description is available for this CVE.	A flaw was found in moodle. A local file may include risks when restoring block backups.

Wed, 28 Aug 2024 01:15:00 +0000

Type	Values Removed	Values Added
Description		No description is available for this CVE.
Title		moodle: LFI vulnerability when restoring malformed block backups
References		https://moodle.org/mod/forum/discuss.php?d=461210 https://nvd.nist.gov/vuln/detail/CVE-2024-43440 https://www.cve.org/CVERecord?id=CVE-2024-43440
Metrics	threat_severity `None`	cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}` threat_severity `Important`

MITRE

Status: PUBLISHED

Assigner: fedora

Published: 2024-11-07T13:32:16.113Z

Updated: 2024-11-07T14:38:59.743Z

Reserved: 2024-08-13T07:15:00.599Z

Link: CVE-2024-43440

Vulnrichment

Updated: 2024-11-07T14:38:53.221Z

NVD

Status : Awaiting Analysis

Published: 2024-11-07T14:15:16.610

Modified: 2024-11-08T19:01:03.880

Link: CVE-2024-43440

Redhat

Severity : Important

Publid Date: 2024-08-19T04:00:00Z

Links: CVE-2024-43440 - Bugzilla

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-43440", "assignerOrgId": "92fb86c3-55a5-4fb5-9c3f-4757b9e96dc5", "state": "PUBLISHED", "assignerShortName": "fedora", "dateReserved": "2024-08-13T07:15:00.599Z", "datePublished": "2024-11-07T13:32:16.113Z", "dateUpdated": "2024-11-07T14:38:59.743Z"}, "containers": {"cna": {"title": "Moodle: lfi vulnerability when restoring malformed block backups", "metrics": [{"other": {"content": {"value": "Important", "namespace": "https://access.redhat.com/security/updates/classification/"}, "type": "Red Hat severity rating"}}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "format": "CVSS"}], "descriptions": [{"lang": "en", "value": "A flaw was found in moodle. A local file may include risks when restoring block backups."}], "affected": [{"versions": [{"status": "affected", "version": "0", "lessThan": "4.1.12", "versionType": "semver"}, {"status": "affected", "version": "4.2", "lessThan": "4.2.9", "versionType": "semver"}, {"status": "affected", "version": "4.3", "lessThan": "4.3.6", "versionType": "semver"}, {"status": "affected", "version": "4.4", "lessThan": "4.4.2", "versionType": "semver"}], "packageName": "moodle", "collectionURL": "https://github.com/moodle/moodle", "defaultStatus": "unaffected"}], "references": [{"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2304269", "name": "RHBZ#2304269", "tags": ["issue-tracking", "x_refsource_REDHAT"]}, {"url": "https://moodle.org/mod/forum/discuss.php?d=461210"}], "datePublic": "2024-08-19T04:00:00+00:00", "timeline": [{"lang": "en", "time": "2024-08-12T00:00:00+00:00", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2024-08-19T04:00:00+00:00", "value": "Made public."}], "credits": [{"lang": "en", "value": "Red Hat would like to thank Paul Holden for reporting this issue."}], "providerMetadata": {"orgId": "92fb86c3-55a5-4fb5-9c3f-4757b9e96dc5", "shortName": "fedora", "dateUpdated": "2024-11-07T13:32:16.113Z"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-22", "lang": "en", "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}], "affected": [{"vendor": "moodle", "product": "moodle", "cpes": ["cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "4.1.12", "versionType": "semver"}, {"version": "4.2", "status": "affected", "lessThan": "4.2.9", "versionType": "semver"}, {"version": "4.3", "status": "affected", "lessThan": "4.3.6", "versionType": "semver"}, {"version": "4.4", "status": "affected", "lessThan": "4.4.2", "versionType": "semver"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-11-07T14:23:21.250549Z", "id": "CVE-2024-43440", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-11-07T14:38:59.743Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-43440", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-11-07T14:23:21.250549Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*"], "vendor": "moodle", "product": "moodle", "versions": [{"status": "affected", "version": "0", "lessThan": "4.1.12", "versionType": "semver"}, {"status": "affected", "version": "4.2", "lessThan": "4.2.9", "versionType": "semver"}, {"status": "affected", "version": "4.3", "lessThan": "4.3.6", "versionType": "semver"}, {"status": "affected", "version": "4.4", "lessThan": "4.4.2", "versionType": "semver"}], "defaultStatus": "unknown"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-11-07T14:38:53.221Z"}}], "cna": {"title": "Moodle: lfi vulnerability when restoring malformed block backups", "credits": [{"lang": "en", "value": "Red Hat would like to thank Paul Holden for reporting this issue."}], "metrics": [{"other": {"type": "Red Hat severity rating", "content": {"value": "Important", "namespace": "https://access.redhat.com/security/updates/classification/"}}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"versions": [{"status": "affected", "version": "0", "lessThan": "4.1.12", "versionType": "semver"}, {"status": "affected", "version": "4.2", "lessThan": "4.2.9", "versionType": "semver"}, {"status": "affected", "version": "4.3", "lessThan": "4.3.6", "versionType": "semver"}, {"status": "affected", "version": "4.4", "lessThan": "4.4.2", "versionType": "semver"}], "packageName": "moodle", "collectionURL": "https://github.com/moodle/moodle", "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2024-08-12T00:00:00+00:00", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2024-08-19T04:00:00+00:00", "value": "Made public."}], "datePublic": "2024-08-19T04:00:00+00:00", "references": [{"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2304269", "name": "RHBZ#2304269", "tags": ["issue-tracking", "x_refsource_REDHAT"]}, {"url": "https://moodle.org/mod/forum/discuss.php?d=461210"}], "descriptions": [{"lang": "en", "value": "A flaw was found in moodle. A local file may include risks when restoring block backups."}], "providerMetadata": {"orgId": "92fb86c3-55a5-4fb5-9c3f-4757b9e96dc5", "shortName": "fedora", "dateUpdated": "2024-11-07T13:32:16.113Z"}}}, "cveMetadata": {"cveId": "CVE-2024-43440", "state": "PUBLISHED", "dateUpdated": "2024-11-07T14:38:59.743Z", "dateReserved": "2024-08-13T07:15:00.599Z", "assignerOrgId": "92fb86c3-55a5-4fb5-9c3f-4757b9e96dc5", "datePublished": "2024-11-07T13:32:16.113Z", "assignerShortName": "fedora"}, "dataVersion": "5.1"}