What’s Vulnerable › Vulnerabilities
CVE-2023-30944: Moodle: minor sql injection risk in external wiki method for listing pages
- Severity: high (CVSS 7.3 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 1.1% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2023-05-02 · updated 2026-06-17
- Weakness: CWE-89
Description
The vulnerability was found Moodle which exists due to insufficient sanitization of user-supplied data in external Wiki method for listing pages. A remote attacker can send a specially crafted request to the affected application and execute limited SQL commands within the application database.
Affected products
- Fedoraproject Extra Packages For Enterprise Linux: 7.0
- Fedoraproject Fedora: 36, 37, 38
- Moodle: from 3.9.0 before 3.9.21; from 3.11.0 before 3.11.14; from 4.0.0 before 4.0.8; from 4.1.0 before 4.1.3 — fixed in 3.11.14, 3.9.21, 4.0.8, 4.1.3
How to fix
Upgrade to a fixed version: Moodle 3.11.14, 3.9.21, 4.0.8, 4.1.3. Check the vendor advisory for mitigations.
References
- http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-77187
- https://bugzilla.redhat.com/show_bug.cgi?id=2188606
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/54TM5H5PDUDYXOQ7X7PPYWP4AJDAE73I/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MZBWRVUJF7HI53XCJPJ3YJZPOV5HBRUY/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PBFSXRYLT4ICKJVQSRBAOUDMDRVSVBLS/
- https://moodle.org/mod/forum/discuss.php?d=446286
- http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-77187
- https://bugzilla.redhat.com/show_bug.cgi?id=2188606
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/54TM5H5PDUDYXOQ7X7PPYWP4AJDAE73I/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MZBWRVUJF7HI53XCJPJ3YJZPOV5HBRUY/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PBFSXRYLT4ICKJVQSRBAOUDMDRVSVBLS/
- https://moodle.org/mod/forum/discuss.php?d=446286
Get alerted when CVE-2023-30944 or the next vulnerability affects your stack