CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
EPSS
Percentile
92.7%
In Moodle before 2.6.4, serialised data passed by repositories could potentially contain objects defined by add-ons that could include executable code (CVE-2014-3541). In Moodle before 2.6.4, it was possible for manipulated XML files passed from LTI servers to be interpreted by Moodle to allow access to server-side files (CVE-2014-3542). In Moodle before 2.6.4, it was possible for manipulated XML files to be uploaded to the IMSCC course format or the IMSCP resource to allow access to server-side files (CVE-2014-3543). In Moodle before 2.6.4, filtering of the Skype profile field was not removing potentially harmful code (CVE-2014-3544). In Moodle before 2.6.4, it was possible to inject code into Calculated questions that would be executed on the server (CVE-2014-3545). In Moodle before 2.6.4, it was possible to get limited user information, such as user name and courses, by manipulating the URL of profile and notes pages (CVE-2014-3546). In Moodle before 2.6.4, the details of badges from external sources were not being filtered (CVE-2014-3547). In Moodle before 2.6.4, content of exception dialogues presented from AJAX calls was not being escaped before being presented to users (CVE-2014-3548). In Moodle before 2.6.4, fields in rubrics were not being correctly filtered (CVE-2014-3551). In Moodle before 2.6.4, forum was allowing users who were members of more than one group to post to all groups without the capability to access all groups (CVE-2014-3553). The moodle package has been updated to version 2.6.4, to fix these issues and other bugs.
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
Mageia | 3 | noarch | moodle | < 2.6.4-1 | moodle-2.6.4-1.mga3 |
Mageia | 4 | noarch | moodle | < 2.6.4-1 | moodle-2.6.4-1.mga4 |
docs.moodle.org/dev/Moodle_2.6.4_release_notes
bugs.mageia.org/show_bug.cgi?id=13759
moodle.org/mod/forum/discuss.php?d=264262
moodle.org/mod/forum/discuss.php?d=264263
moodle.org/mod/forum/discuss.php?d=264264
moodle.org/mod/forum/discuss.php?d=264265
moodle.org/mod/forum/discuss.php?d=264266
moodle.org/mod/forum/discuss.php?d=264267
moodle.org/mod/forum/discuss.php?d=264268
moodle.org/mod/forum/discuss.php?d=264269
moodle.org/mod/forum/discuss.php?d=264270
moodle.org/mod/forum/discuss.php?d=264273