4

CVE-2015-2267

mdeploy.php in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4 allows remote authenticated users to bypass intended access restrictions and extract archives to arbitrary directories via a crafted dataroot value.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Moodle ≫ Moodle Version <= 2.5.9
Moodle ≫ Moodle Version 2.5.0
Moodle ≫ Moodle Version 2.5.1
Moodle ≫ Moodle Version 2.5.2
Moodle ≫ Moodle Version 2.5.3
Moodle ≫ Moodle Version 2.5.4
Moodle ≫ Moodle Version 2.5.5
Moodle ≫ Moodle Version 2.5.6
Moodle ≫ Moodle Version 2.5.7
Moodle ≫ Moodle Version 2.5.8
Moodle ≫ Moodle Version 2.6.0
Moodle ≫ Moodle Version 2.6.1
Moodle ≫ Moodle Version 2.6.2
Moodle ≫ Moodle Version 2.6.3
Moodle ≫ Moodle Version 2.6.4
Moodle ≫ Moodle Version 2.6.5
Moodle ≫ Moodle Version 2.6.6
Moodle ≫ Moodle Version 2.6.7
Moodle ≫ Moodle Version 2.6.8
Moodle ≫ Moodle Version 2.7.0
Moodle ≫ Moodle Version 2.7.1
Moodle ≫ Moodle Version 2.7.2
Moodle ≫ Moodle Version 2.7.3
Moodle ≫ Moodle Version 2.7.4
Moodle ≫ Moodle Version 2.7.5
Moodle ≫ Moodle Version 2.8.0
Moodle ≫ Moodle Version 2.8.1
Moodle ≫ Moodle Version 2.8.2
Moodle ≫ Moodle Version 2.8.3
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.62% 0.73
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 4 8 2.9
AV:N/AC:L/Au:S/C:N/I:P/A:N
CWE-284 Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

http://openwall.com/lists/oss-security/2015/03/16/1
http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-49087
https://moodle.org/mod/forum/discuss.php?d=307381
Vendor Advisory