CVE-2023-30943

Deeper analysis

The vulnerability affects Moodle and stems from improper handling of folder paths in TinyMCE loaders, where user input can control the destination directory. This allows creation of arbitrary folders via external control of file paths, tracked under CWE-73 and CWE-610, with a CVSS 3.1 score of 6.5 reflecting network attack vector, low complexity, and high integrity impact without requiring authentication.

A remote attacker can exploit the flaw by sending a specially crafted HTTP request that manipulates the folder creation path in the TinyMCE component. Successful exploitation enables the attacker to create arbitrary directories on the underlying system, potentially facilitating further unauthorized modifications or preparation for additional attacks, though user interaction is required per the CVSS metrics.

Advisories reference a Moodle git commit addressing MDL-77718 along with Red Hat and Fedora package updates that distribute the necessary patches to affected installations. These updates are available through standard distribution channels to remediate the path control issue. The associated EPSS score has remained stable near 0.26 with no material increase after disclosure.