Staging Environment: Content and features may be unstable or change without notice.
Advisory details: github_osv / GHSA-27j2-c838-c3qg
Advisory ID github_osv/GHSA-27j2-c838-c3qg
Aliases CVE-2014-3543
Summary Moodle Arbitrary File Read via XML External Entity vulnerability `mod/imscp/locallib.php` in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allows remote attackers to read arbitrary files via a package with a manifest file containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue affecting IMSCP resources and the IMSCC format.
Status Published
Exploitability 0.5
Weighted Severity 0.0
Risk
Affected and Fixed Packages Package Details
Introduced and Fixed Package Commit Patches Package Commit Patches Details
Weaknesses (1)
CWE-611 Improper Restriction of XML External Entity Reference
System Score Found at
generic_textual MODERATE
Reference id Reference type URL
http://openwall.com/lists/oss-security/2014/07/21/1
https://github.com/moodle/moodle
https://github.com/moodle/moodle/commit/595ef4772d330a20c757635ab090acdcc9b2a2fa
https://git.moodle.org/gw?p=moodle.git;a=commit;h=595ef4772d330a20c757635ab090acdcc9b2a2fa
https://moodle.org/mod/forum/discuss.php?d=264264
CVE-2014-3543 https://nvd.nist.gov/vuln/detail/CVE-2014-3543
No exploits are available.

No EPSS data available for this advisory.

Patch URL
There are no known patches.
There are no known vectors.

There are no SSVC decisions available.