CVE-2024-34004

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user with both access to restore wiki modules and direct access to the web server outside of the Moodle webroot could execute a local file include.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-200

Affected software

No affected versions have been published.

Timeline

Published: May 31, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-340056.5In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user with both access to resto CVE-2024-340064.3The site log report required additional encoding of event descriptions to ensure any HTML in the content is displayed in plaintext instead o CVE-2024-340078.8The logout option within MFA did not include the necessary token to avoid the risk of users inadvertently being logged out via CSRF.CVE-2024-340088.8Actions in the admin management of analytics models did not include the necessary token to prevent a CSRF risk.CVE-2024-340097.5Insufficient checks whether ReCAPTCHA was enabled made it possible to bypass the checks on the login page. This did not affect other pages w CVE-2024-340108.2Local privilege escalation due to unquoted search path vulnerability. The following products are affected: Acronis Cyber Protect Cloud Agent CVE-2024-340116.8Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Cyber Protect Cloud Agent (Windo CVE-2024-340124.4Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Cloud Manager (Windows) before b CVE-2024-340137.8Local privilege escalation due to OS command injection vulnerability. The following products are affected: Acronis True Image (macOS) before CVE-2024-340145.5Arbitrary file overwrite during recovery due to improper symbolic link handling. The following products are affected: Acronis Backup plugin CVE-2024-340153.3Sensitive information disclosure during file browsing due to improper symbolic link handling. The following products are affected: Acronis B CVE-2024-340166.5Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Protect Cloud Agent (Windo