GitHub Advisoryadvisory · Packagist

GHSA-58fm-v4pr-jh8p Moodle Unrestricted file upload vulnerability

HIGH Published 2022-05-17 Modified 2024-04-23 Official page ↗
Aliases
CVE-2016-9187
Ecosystem
Packagist
Packages
moodle/moodle
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-434
Reviewed
2024-04-23

Affected packages

• Packagist moodle/moodle: >= 2.0.1, <= 3.2.1 (no fix yet)

Description

Unrestricted file upload vulnerability in the double extension support in the "image" module in Moodle 3.1.2 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, and then accessing it via unspecified vectors.

Related

Alias · CVE (1)

  • CVE-2016-9187 Unrestricted file upload vulnerability in the double extension support in the "image" module in Moodle 3.1.2 allows remote authenticated… vulnerability

Weakness · CWE (1)

  • CWE-434 Unrestricted Upload of File with Dangerous Type weakness

References