GitHub Advisoryadvisory · Packagist

GHSA-x7r4-26m9-hmgq Moodle vulnerable to symlink attack

MEDIUM Published 2022-05-17 Modified 2024-02-09 Official page ↗
Aliases
CVE-2008-5153
Ecosystem
Packagist
Packages
moodle/moodle
Severity
Moderate
Weaknesses
CWE-59
Reviewed
2024-02-09

Affected packages

• Packagist moodle/moodle: >= 1.9.0, < 1.9.4 → fixed in 1.9.4 • Packagist moodle/moodle: >= 1.8.0, < 1.8.8 → fixed in 1.8.8 • Packagist moodle/moodle: >= 1.7.0, < 1.7.7 → fixed in 1.7.7 • Packagist moodle/moodle: >= 1.6.0, < 1.6.9 → fixed in 1.6.9

Description

`spell-check-logic.cgi` in Moodle 1.9 before 1.9.4, 1.8 before 1.8.8, 1.7 before 1.7.7 and 1.6 before 1.6.9 allows local users to overwrite arbitrary files via a symlink attack on the (1) `/tmp/spell-check-debug.log`, (2) `/tmp/spell-check-before`, or (3) `/tmp/spell-check-after` temporary file.

Related

Alias · CVE (1)

  • CVE-2008-5153 spell-check-logic.cgi in Moodle 1.8.2 allows local users to overwrite arbitrary files via a symlink attack on the (1)… vulnerability

Weakness · CWE (1)

  • CWE-59 Improper Link Resolution Before File Access weakness

References