Lucene search

RedhatCVE-2014-3543

HistoryJul 29, 2014 - 11:10 a.m.

CVE-2014-3543

2014-07-2911:10:31

CWE-200

redhat

web.nvd.nist.gov

cve-2014-3543

moodle

security vulnerability

imscp

xxe

nvd

file read

remote attackers

xml

entity reference

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

AI Score

6.5

Confidence

Low

EPSS

0.003

Percentile

70.3%

JSON

mod/imscp/locallib.php in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allows remote attackers to read arbitrary files via a package with a manifest file containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue affecting IMSCP resources and the IMSCC format.

Affected configurations

Nvd

Node

moodlemoodleRange≤2.3.11

moodlemoodleMatch2.3.0

moodlemoodleMatch2.3.1

moodlemoodleMatch2.3.2

moodlemoodleMatch2.3.3

moodlemoodleMatch2.3.4

moodlemoodleMatch2.3.5

moodlemoodleMatch2.3.6

moodlemoodleMatch2.3.7

moodlemoodleMatch2.3.8

moodlemoodleMatch2.3.9

moodlemoodleMatch2.3.10

Node

moodlemoodleMatch2.5.0

moodlemoodleMatch2.5.1

moodlemoodleMatch2.5.2

moodlemoodleMatch2.5.3

moodlemoodleMatch2.5.4

moodlemoodleMatch2.5.5

moodlemoodleMatch2.5.6

Node

moodlemoodleMatch2.6.0

moodlemoodleMatch2.6.1

moodlemoodleMatch2.6.2

moodlemoodleMatch2.6.3

Node

moodlemoodleMatch2.4.0

moodlemoodleMatch2.4.1

moodlemoodleMatch2.4.2

moodlemoodleMatch2.4.3

moodlemoodleMatch2.4.4

moodlemoodleMatch2.4.5

moodlemoodleMatch2.4.6

moodlemoodleMatch2.4.7

moodlemoodleMatch2.4.8

moodlemoodleMatch2.4.9

moodlemoodleMatch2.4.10

Node

moodlemoodleMatch2.7.0

VendorProductVersionCPE
moodlemoodle*cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*
moodlemoodle2.3.0cpe:2.3:a:moodle:moodle:2.3.0:*:*:*:*:*:*:*
moodlemoodle2.3.1cpe:2.3:a:moodle:moodle:2.3.1:*:*:*:*:*:*:*
moodlemoodle2.3.2cpe:2.3:a:moodle:moodle:2.3.2:*:*:*:*:*:*:*
moodlemoodle2.3.3cpe:2.3:a:moodle:moodle:2.3.3:*:*:*:*:*:*:*
moodlemoodle2.3.4cpe:2.3:a:moodle:moodle:2.3.4:*:*:*:*:*:*:*
moodlemoodle2.3.5cpe:2.3:a:moodle:moodle:2.3.5:*:*:*:*:*:*:*
moodlemoodle2.3.6cpe:2.3:a:moodle:moodle:2.3.6:*:*:*:*:*:*:*
moodlemoodle2.3.7cpe:2.3:a:moodle:moodle:2.3.7:*:*:*:*:*:*:*
moodlemoodle2.3.8cpe:2.3:a:moodle:moodle:2.3.8:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
moodle	moodle	*	cpe:2.3:a:moodle:moodle::::::::
moodle	moodle	2.3.0	cpe:2.3:a:moodle:moodle:2.3.0:::::::*
moodle	moodle	2.3.1	cpe:2.3:a:moodle:moodle:2.3.1:::::::*
moodle	moodle	2.3.2	cpe:2.3:a:moodle:moodle:2.3.2:::::::*
moodle	moodle	2.3.3	cpe:2.3:a:moodle:moodle:2.3.3:::::::*
moodle	moodle	2.3.4	cpe:2.3:a:moodle:moodle:2.3.4:::::::*
moodle	moodle	2.3.5	cpe:2.3:a:moodle:moodle:2.3.5:::::::*
moodle	moodle	2.3.6	cpe:2.3:a:moodle:moodle:2.3.6:::::::*
moodle	moodle	2.3.7	cpe:2.3:a:moodle:moodle:2.3.7:::::::*
moodle	moodle	2.3.8	cpe:2.3:a:moodle:moodle:2.3.8:::::::*