Threats tagged 'bit-moodle-2024-34004'

CVE-2024-34004 is a medium severity vulnerability in Moodle affecting certain versions prior to 4.1.10, between 4.2.0 and 4.2.7, and between 4.3.0 and 4.3.4. It allows an authenticated Moodle user with permissions to restore wiki modules and direct web server access outside the Moodle webroot in misconfigured shared hosting environments to perform a local file inclusion (LFI) attack. This vulnerability arises only if the hosting environment improperly allows access to other users' content. A patch is available to address this issue.