GitHub Advisoryadvisory · Packagist

GHSA-fccf-p8fx-vjj4 Moodle vulnerable to PHP object injection attacks

HIGH Published 2022-05-13 Modified 2024-01-24 Official page ↗
Aliases
CVE-2014-3541
Ecosystem
Packagist
Packages
moodle/moodle
Severity
High
Weaknesses
CWE-94
Reviewed
2024-01-24

Affected packages

• Packagist moodle/moodle: < 2.4.11 → fixed in 2.4.11 • Packagist moodle/moodle: >= 2.5.0, < 2.5.7 → fixed in 2.5.7 • Packagist moodle/moodle: >= 2.6.0, < 2.6.4 → fixed in 2.6.4 • Packagist moodle/moodle: >= 2.7.0, < 2.7.1 → fixed in 2.7.1

Description

The Repositories component in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allows remote attackers to conduct PHP object injection attacks and execute arbitrary code via serialized data associated with an add-on.

Related

Alias · CVE (1)

  • CVE-2014-3541 The Repositories component in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1… vulnerability

Weakness · CWE (1)

  • CWE-94 Improper Control of Generation of Code weakness

References