GitHub Advisoryadvisory · Packagist

GHSA-cm4r-58pj-h2ph Moodle allows attackers to extract archives to arbitrary directories

MEDIUM Published 2022-05-13 Modified 2024-01-25 Official page ↗
Aliases
CVE-2015-2267
Ecosystem
Packagist
Packages
moodle/moodle
Severity
Moderate
Weaknesses
CWE-284
Reviewed
2024-01-25

Affected packages

• Packagist moodle/moodle: < 2.6.9 → fixed in 2.6.9 • Packagist moodle/moodle: >= 2.7.0, < 2.7.6 → fixed in 2.7.6 • Packagist moodle/moodle: >= 2.8.0, < 2.8.4 → fixed in 2.8.4

Description

mdeploy.php in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4 allows remote authenticated users to bypass intended access restrictions and extract archives to arbitrary directories via a crafted dataroot value.

Related

Alias · CVE (1)

  • CVE-2015-2267 mdeploy.php in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4 allows remote authenticated users to… vulnerability

Weakness · CWE (1)

  • CWE-284 Improper Access Control weakness

References