Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2023-30943— Moodle: tinymce loaders susceptible to arbitrary folder creation

Quick assessment

Affected
CVE-2023-30943
Exploitation
Public or AI PoC available; prioritize validation
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Moodle是一套免费、开源的电子学习软件平台，也称课程管理系统、学习管理系统或虚拟学习环境。 Moodle存在安全漏洞，该漏洞源于允许用户控制要在TinyMCE加载程序中创建的旧文件的路径，远程用户可以发送特制的HTTP请求并在系统上创建任意文件夹。

CVSS 6.5 · Medium EPSS 6.58% · P94

Public Exploits 1

Nuclei · 1 CVE-2023-30943.yaml [template]

Possible ATT&CK Techniques 1 AI

T1059 · Command and Scripting Interpreter

I. Basic Information for CVE-2023-30943

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Moodle: tinymce loaders susceptible to arbitrary folder creation
Source: CVE Program / CVE List V5
Vulnerability Description
The vulnerability was found Moodle which exists because the application allows a user to control path of the older to create in TinyMCE loaders. A remote user can send a specially crafted HTTP request and create arbitrary folders on the system.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
文件名或路径的外部可控制
Source: CVE Program / CVE List V5
Vulnerability Title
Moodle 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Moodle是一套免费、开源的电子学习软件平台，也称课程管理系统、学习管理系统或虚拟学习环境。 Moodle存在安全漏洞，该漏洞源于允许用户控制要在TinyMCE加载程序中创建的旧文件的路径，远程用户可以发送特制的HTTP请求并在系统上创建任意文件夹。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

II. Public POCs for CVE-2023-30943

# POC Description Source Link Shenlong Link
1 CVE-2023-30943 RCE PoC https://github.com/d0rb/CVE-2023-30943 POC Details
2 A Python-based tool to detect the CVE-2023-30943 vulnerability in Moodle, which allows unauthorized folder creation via specially crafted requests in TinyMCE loaders. https://github.com/Chocapikk/CVE-2023-30943 POC Details
3 CVE-2023-30943 (Moodle XSS) https://github.com/RubyCat1337/CVE-2023-30943 POC Details
4 The vulnerability was found Moodle which exists because the application allows a user to control path of the older to create in TinyMCE loaders. A remote user can send a specially crafted HTTP request and create arbitrary folders on the system. Moodle versions 4.1.x before 4.1.3 and 4.2.x before 4.2.0 are susceptible to an unauthenticated arbitrary folder creation, tracked as CVE-2023-30943. An attacker can leverage the creation of arbitrary folders to carry out a Stored Cross-Site Scripting (XSS) attack on the administration panel, resulting in arbitrary code execution on the server as soon as an administrator visits the panel. https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-30943.yaml POC Details
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2023-30943

请登录查看更多情报信息。

Vendor Advisories for CVE-2023-30943 (1)

Mailing List Discussions for CVE-2023-30943 (3)

Other References for CVE-2023-30943 (2)

IV. Related Vulnerabilities

Same weakness: CWE-73

V. Comments for CVE-2023-30943

No comments yet

Leave a comment