Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
githubGitHub Advisory DatabaseGHSA-27J2-C838-C3QG
HistoryMay 13, 2022 - 1:12 a.m.

Moodle Arbitrary File Read via XML External Entity vulnerability

2022-05-1301:12:40
CWE-611
GitHub Advisory Database
github.com
15
moodle
locallib.php
vulnerability
remote file read
xml external entity
imscp resources

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

EPSS

0.003

Percentile

70.3%

JSON

mod/imscp/locallib.php in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allows remote attackers to read arbitrary files via a package with a manifest file containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue affecting IMSCP resources and the IMSCC format.

Affected configurations

Vulners
Node
moodlemoodleRange≤2.4.10
OR
moodlemoodleRange≤2.5.6
OR
moodlemoodleRange≤2.6.3
OR
moodlemoodleMatch2.7.0
VendorProductVersionCPE
moodlemoodle*cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*
moodlemoodle2.7.0cpe:2.3:a:moodle:moodle:2.7.0:*:*:*:*:*:*:*

Related

prion 1
ubuntucve 1
veracode 1
nvd 1
cvelist 1
osv 1
cve 1
nessus 3
mageia 1
openvas 6
fedora 5
prion
prion
Xxe
2014-07-29 11:10:00
ubuntucve
ubuntucve
CVE-2014-3543
2014-07-29 00:00:00
veracode
veracode
XML External Entity (XXE) Injection
2017-07-05 07:41:40
nvd
nvd
CVE-2014-3543
2014-07-29 11:10:31
cvelist
cvelist
CVE-2014-3543
2014-07-29 10:00:00
osv
osv
Moodle Arbitrary File Read via XML External Entity vulnerability
2022-05-13 01:12:40
cve
cve
CVE-2014-3543
2014-07-29 11:10:31
nessus
nessus
Moodle < 2.4 / 2.4.x < 2.4.11 / 2.5.x < 2.5.7 / 2.6.x < 2.6.4 / 2.7.x < 2.7.1 Multiple Vulnerabilities
2015-04-20 00:00:00
Fedora 19 : moodle-2.4.11-1.fc19 (2014-8609)
2014-07-31 00:00:00
Fedora 20 : moodle-2.5.7-1.fc20 (2014-8601)
2014-07-31 00:00:00
mageia
mageia
Updated moodle package fixes security vulnerabilities
2014-08-06 00:08:48
openvas
openvas
Mageia: Security Advisory (MGASA-2014-0308)
2022-01-28 00:00:00
Fedora Update for moodle FEDORA-2014-10802
2014-10-01 00:00:00
Fedora Update for moodle FEDORA-2014-8609
2014-08-05 00:00:00
fedora
fedora
[SECURITY] Fedora 20 Update: moodle-2.5.9-1.fc20
2014-11-25 15:30:01
[SECURITY] Fedora 19 Update: moodle-2.4.11-1.fc19
2014-07-30 06:59:58
[SECURITY] Fedora 20 Update: moodle-2.5.7-1.fc20
2014-07-30 07:03:13

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

EPSS

0.003

Percentile

70.3%

JSON
Related for GHSA-27J2-C838-C3QG
prion1ubuntucve1veracode1nvd1cvelist1osv1cve1nessus3mageia1openvas6fedora5