Staging Environment: Content and features may be unstable or change without notice.
Advisory details: github_osv / GHSA-xmwv-mqh8-4xgw
Advisory ID github_osv/GHSA-xmwv-mqh8-4xgw
Aliases CVE-2014-3542
Summary Moodle allows remote attackers to read arbitrary files mod/lti/service.php in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allows remote attackers to read arbitrary files via an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
Status Published
Exploitability 0.5
Weighted Severity 0.0
Risk
Affected and Fixed Packages Package Details
Introduced and Fixed Package Commit Patches Package Commit Patches Details
Weaknesses (1)
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
System Score Found at
generic_textual MODERATE
Reference id Reference type URL
http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-45463
http://openwall.com/lists/oss-security/2014/07/21/1
https://github.com/moodle/moodle
https://github.com/moodle/moodle/commit/78ed99ec7e5e75b283e844adb058140d6ba0ff14
https://moodle.org/mod/forum/discuss.php?d=264263
CVE-2014-3542 https://nvd.nist.gov/vuln/detail/CVE-2014-3542
No exploits are available.

No EPSS data available for this advisory.

Patch URL
There are no known patches.
There are no known vectors.

There are no SSVC decisions available.