GitHub Advisoryadvisory · Packagist

GHSA-66xp-28cq-mrf2 Moodle Denial of Service

HIGH Published 2022-05-24 Modified 2024-04-23 Official page ↗
Aliases
CVE-2020-25630
Ecosystem
Packagist
Packages
moodle/moodle
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-400
Reviewed
2024-04-23

Affected packages

• Packagist moodle/moodle: >= 3.9, < 3.9.2 → fixed in 3.9.2 • Packagist moodle/moodle: >= 3.8, < 3.8.5 → fixed in 3.8.5 • Packagist moodle/moodle: >= 3.7, < 3.7.8 → fixed in 3.7.8 • Packagist moodle/moodle: >= 3.5, < 3.5.14 → fixed in 3.5.14

Description

A vulnerability was found in Moodle where the decompressed size of zip files was not checked against available user quota before unzipping them, which could lead to a denial of service risk. This affects versions 3.9 to 3.9.1, 3.8 to 3.8.4, 3.7 to 3.7.7, 3.5 to 3.5.13 and earlier unsupported versions. Fixed in 3.9.2, 3.8.5, 3.7.8 and 3.5.14.

Related

Alias · CVE (1)

  • CVE-2020-25630 A vulnerability was found in Moodle where the decompressed size of zip files was not checked against available user quota before unzipping… vulnerability

Weakness · CWE (1)

  • CWE-400 Uncontrolled Resource Consumption weakness

References