Moodle Dropbox Repository Remote Code Execution Vulnerability

A remote code execution vulnerability has been identified in the Moodle Learning Management System (LMS) Dropbox repository. This issue affects versions 4.5 to 4.5.3, 4.4 to 4.4.7, 4.3 to 4.3.11, 4.1 to 4.1.17, and earlier unsupported versions. The vulnerability is accessible by default only to teachers and managers on sites with the Dropbox repository enabled.

Impact

Exploitation of this vulnerability allows for authenticated remote code execution on the affected Moodle instance.

Remediation

Users can upgrade to Moodle versions 4.5.4, 4.4.8, 4.3.12, or 4.1.18 to address this vulnerability. Alternatively, the Dropbox repository can be disabled in the site administration settings until the update is applied.