GHSA-xmwv-mqh8-4xgwMedium

Moodle allows remote attackers to read arbitrary files

Published
May 13, 2022
Last Modified
January 19, 2024

🔗 CVE IDs covered (1)

CVE-2014-3542 →

📋 Description

mod/lti/service.php in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allows remote attackers to read arbitrary files via an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

🎯 Affected products5

  • composer/moodle/moodle:<= 2.3.11
  • composer/moodle/moodle:>= 2.4.0, < 2.4.11
  • composer/moodle/moodle:>= 2.5.0, < 2.5.7
  • composer/moodle/moodle:>= 2.6.0, < 2.6.4
  • composer/moodle/moodle:= 2.7.0

🔗 References (6)