CVE-2023-30943 is a medium-severity vulnerability in Moodle, affecting various Fedora Project and Moodle packages, where an unauthenticated remote attacker can create arbitrary folders on the system. This is due to improper path control in TinyMCE loaders, allowing a specially crafted HTTP request to bypass security measures. While the CVSS score is 5.3 (Medium), its FAUCET Risk Score of 91/100 indicates a higher practical risk. There is no evidence of active exploitation, Metasploit modules, or ExploitDB entries, though Nuclei templates exist for related vulnerabilities. Community discussion and media coverage are minimal.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 4.1.0, < 4.1.3CPE matchmatch criteria | cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:* | ||
7.0CPE matchmatch criteria | cpe:2.3:a:fedoraproject:extra_packages_for_enterprise_linux:7.0:*:*:*:*:*:*:* | ||
36CPE matchmatch criteria | cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:* | ||
37CPE matchmatch criteria | cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* | ||
38CPE matchmatch criteria | cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.