CVE-2024-34002: 
PHP vulnerability analysis and mitigation

CVE-2024-34002 is a Local File Inclusion (LFI) vulnerability discovered in Moodle's feedback module. The vulnerability affects Moodle versions 4.0 to 4.3.3, 4.2 to 4.2.6, 4.1 to 4.1.9, and earlier unsupported versions. The issue was discovered by Vincent Schneider (cli-ish) and was fixed in versions 4.3.4, 4.2.7, and 4.1.10 (Moodle Forum).

The vulnerability exists in shared hosting environments that have been misconfigured to allow access to other users' content. A Moodle user with both access to restore feedback modules and direct access to the web server outside of the Moodle webroot could execute a local file include. The vulnerability has been classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) and has received a CVSS v3.1 score of 6.5 (MEDIUM) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N (NVD).

The vulnerability could allow an authenticated attacker to execute a local file include in misconfigured shared hosting environments, potentially exposing sensitive information to unauthorized actors (NVD).

The vulnerability requires an authenticated user with specific permissions (access to restore feedback modules) and access to the web server outside of the Moodle webroot. The attack is only possible in shared hosting environments that have been misconfigured to allow access to other users' content (Moodle Forum).

The vulnerability has been patched in Moodle versions 4.3.4, 4.2.7, and 4.1.10. Users are advised to upgrade to these versions or later to mitigate the risk. Organizations using earlier unsupported versions should upgrade to a supported version with the security fix (Moodle Forum).