CVE-2023-23923

HighCVSS 8.2/10Last modified Jun 17, 2026

Description

The vulnerability was found Moodle which exists due to insufficient limitations on the "start page" preference. A remote attacker can set that preference for another user. The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.

Metrics

CVSS 3.1 8.2/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Weakness enumeration

CWE-284

Affected software

Vendor	Product	Versions
—	—	>= 4.1.0, < 4.1.1; >= 4.0.0, < 4.0.6; >= 3.11.0, < 3.11.12; < 3.9.19

References

http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-76862Patch
https://bugzilla.redhat.com/show_bug.cgi?id=2162549Issue Tracking, Third Party Advisory
https://moodle.org/mod/forum/discuss.php?d=443274#p1782023Vendor Advisory
http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-76862Patch
https://bugzilla.redhat.com/show_bug.cgi?id=2162549Issue Tracking, Third Party Advisory
https://moodle.org/mod/forum/discuss.php?d=443274#p1782023Vendor Advisory

Timeline

Published: Feb 17, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-239249.8Dompdf is an HTML to PDF converter. The URI validation on dompdf 2.0.1 can be bypassed on SVG parsing by passing `<image>` tags with upperca CVE-2023-239257.5Switcher Client is a JavaScript SDK to work with Switcher API which is cloud-based Feature Flag. Unsanitized input flows into Strategy match CVE-2023-239268.1APOC (Awesome Procedures on Cypher) is an add-on library for Neo4j. An XML External Entity (XXE) vulnerability found in the apoc.import.grap CVE-2023-239275.4Craft is a platform for creating digital experiences. When you insert a payload inside a label name or instruction of an entry type, an cros CVE-2023-239289.8reason-jose is a JOSE implementation in ReasonML and OCaml.`Jose.Jws.validate` does not check HS256 signatures. This allows tampering of JWS CVE-2023-239298.8vantage6 is a privacy preserving federated learning infrastructure for secure insight exchange. Currently, the refresh token is valid indefi CVE-2023-23934.8A vulnerability was found in Netgear SRX5308 up to 4.3.5-3. It has been declared as problematic. Affected by this vulnerability is an unknow CVE-2023-239307.2vantage6 is privacy preserving federated learning infrastructure. Versions prior to 4.0.0 use pickle, which has known security issue, as a d CVE-2023-239316.5cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In affected versions `Cipher.update_CVE-2023-239327.5OpenDDS is an open source C++ implementation of the Object Management Group (OMG) Data Distribution Service (DDS). OpenDDS applications that CVE-2023-239334.3OpenSearch Anomaly Detection identifies atypical data and receives automatic notifications. There is an issue with the application of docume CVE-2023-239343.5Werkzeug is a comprehensive WSGI web application library. Browsers may allow "nameless" cookies that look like `=value` instead of `key=valu