GitHub Advisoryadvisory · Packagist

GHSA-8rc7-4qfv-4484 Moodle does not properly restrict file access

MEDIUM Published 2022-05-13 Modified 2024-01-24 Official page ↗
Aliases
CVE-2014-0216
Ecosystem
Packagist
Packages
moodle/moodle
Severity
Moderate
Reviewed
2024-01-24

Affected packages

• Packagist moodle/moodle: < 2.4.10 → fixed in 2.4.10 • Packagist moodle/moodle: >= 2.5.0, < 2.5.6 → fixed in 2.5.6 • Packagist moodle/moodle: >= 2.6.0, < 2.6.3 → fixed in 2.6.3

Description

The My Home implementation in the block_html_pluginfile function in blocks/html/lib.php in Moodle through 2.3.11, 2.4.x before 2.4.10, 2.5.x before 2.5.6, and 2.6.x before 2.6.3 does not properly restrict file access, which allows remote attackers to obtain sensitive information by visiting an HTML block.

Related

Alias · CVE (1)

  • CVE-2014-0216 The My Home implementation in the block_html_pluginfile function in blocks/html/lib.php in Moodle through 2.3.11, 2.4.x before 2.4.10,… vulnerability

References