moodle: authenticated LFI risk in some misconfigured shared hosting environments via modified mod_wiki backup (CVE-2024-34004)
CVE-2024-34004 is a medium severity vulnerability in Moodle affecting certain versions prior to 4.1.10, between 4.2.0 and 4.2.7, and between 4.3.0 and 4.3.4. It allows an authenticated Moodle user with permissions to restore wiki modules and direct web server access outside the Moodle webroot in misconfigured shared hosting environments to perform a local file inclusion (LFI) attack. This vulnerability arises only if the hosting environment improperly allows access to other users' content. A patch is available to address this issue.
AI Analysis
Technical Summary
In misconfigured shared hosting environments where users can access content outside their own webroot, an authenticated Moodle user with the ability to restore wiki modules can exploit a local file inclusion vulnerability via a modified mod_wiki backup. This flaw affects Moodle versions <4.1.10, >=4.2.0 <4.2.7, and >=4.3.0 <4.3.4. The vulnerability requires both specific permissions within Moodle and direct web server access outside the Moodle webroot, limiting its scope to certain hosting setups. A patch is available to remediate this issue.
Potential Impact
An attacker who is an authenticated Moodle user with restore wiki module permissions and direct web server access outside the Moodle webroot in a misconfigured shared hosting environment can execute local file inclusion. This could potentially allow reading or including arbitrary files on the server, depending on the environment configuration. The impact is limited by the requirement of both specific Moodle permissions and hosting misconfiguration.
Mitigation Recommendations
A patch is available for this vulnerability. Administrators should apply the official Moodle updates that fix this issue in the affected versions. Additionally, ensuring proper isolation and configuration of shared hosting environments to prevent unauthorized access to other users' content will mitigate the risk. No vendor advisory indicating 'no action required' or 'already mitigated' is provided, so patching is recommended.
moodle: authenticated LFI risk in some misconfigured shared hosting environments via modified mod_wiki backup (CVE-2024-34004)
Description
CVE-2024-34004 is a medium severity vulnerability in Moodle affecting certain versions prior to 4.1.10, between 4.2.0 and 4.2.7, and between 4.3.0 and 4.3.4. It allows an authenticated Moodle user with permissions to restore wiki modules and direct web server access outside the Moodle webroot in misconfigured shared hosting environments to perform a local file inclusion (LFI) attack. This vulnerability arises only if the hosting environment improperly allows access to other users' content. A patch is available to address this issue.
Affected software
pkg:bitnami/moodleRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
In misconfigured shared hosting environments where users can access content outside their own webroot, an authenticated Moodle user with the ability to restore wiki modules can exploit a local file inclusion vulnerability via a modified mod_wiki backup. This flaw affects Moodle versions <4.1.10, >=4.2.0 <4.2.7, and >=4.3.0 <4.3.4. The vulnerability requires both specific permissions within Moodle and direct web server access outside the Moodle webroot, limiting its scope to certain hosting setups. A patch is available to remediate this issue.
Potential Impact
An attacker who is an authenticated Moodle user with restore wiki module permissions and direct web server access outside the Moodle webroot in a misconfigured shared hosting environment can execute local file inclusion. This could potentially allow reading or including arbitrary files on the server, depending on the environment configuration. The impact is limited by the requirement of both specific Moodle permissions and hosting misconfiguration.
Mitigation Recommendations
A patch is available for this vulnerability. Administrators should apply the official Moodle updates that fix this issue in the affected versions. Additionally, ensuring proper isolation and configuration of shared hosting environments to prevent unauthorized access to other users' content will mitigate the risk. No vendor advisory indicating 'no action required' or 'already mitigated' is provided, so patching is recommended.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- BIT-moodle-2024-34004
- Osv Schema Version
- 1.6.2
- Aliases
- ["CVE-2024-34004"]
- Ecosystems
- ["Bitnami"]
- Database Specific Severity
- Medium
Threat ID: 6aa00618acd9273b49ab77a9
Added to database: 09/08/2026, 12:56:56 UTC
Last enriched: 09/08/2026, 13:44:27 UTC
Last updated: 09/10/2026, 19:36:48 UTC
Views: 10
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.