Moodle Arbitrary File Read via XML External Entity vulnerability
Impact
mod/imscp/locallib.php in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allows remote attackers to read arbitrary files via a package with a manifest file containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue affecting IMSCP resources and the IMSCC format.
Source excerpt · OSVAffected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
| Affected range | Recorded fix |
|---|---|
| From 2.7.0 before 2.7.1Ecosystem versions | 2.7.1 |
| From 2.6.0 before 2.6.4Ecosystem versions | 2.6.4 |
| From 2.5.0 before 2.5.7Ecosystem versions | 2.5.7 |
| Earlier releases before 2.4.11Ecosystem versions | 2.4.11 |
Version evidence: OSV · GHSA-27j2-c838-c3qg
View original version evidence (33 explicit versions)
Original source description
mod/imscp/locallib.php in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allows remote attackers to read arbitrary files via a package with a manifest file containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue affecting IMSCP resources and the IMSCC format.
References
- Security advisory nvd.nist.gov/vuln/detail/CVE-2014-3543
- Patch github.com/moodle/moodle/commit/595ef4772d330a20c757635ab090acdcc9b2a2fa
- Source reference git.moodle.org/gw
- Source reference github.com/moodle/moodle
- Source reference moodle.org/mod/forum/discuss.php
- Security advisory openwall.com/lists/oss-security/2014/07/21/1