Search for vulnerabilities
Vulnerability details: VCID-xnxa-fxgg-mfcj
Vulnerability ID VCID-xnxa-fxgg-mfcj
Aliases CVE-2014-3543
GHSA-27j2-c838-c3qg
Summary Moodle Arbitrary File Read via XML External Entity vulnerability `mod/imscp/locallib.php` in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allows remote attackers to read arbitrary files via a package with a manifest file containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue affecting IMSCP resources and the IMSCC format.
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (4)
CWE-611 Improper Restriction of XML External Entity Reference
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
generic_textual MODERATE http://openwall.com/lists/oss-security/2014/07/21/1
epss 0.00427 https://api.first.org/data/v1/epss?cve=CVE-2014-3543
epss 0.00427 https://api.first.org/data/v1/epss?cve=CVE-2014-3543
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-27j2-c838-c3qg
generic_textual MODERATE https://github.com/moodle/moodle
generic_textual MODERATE https://github.com/moodle/moodle/commit/595ef4772d330a20c757635ab090acdcc9b2a2fa
generic_textual MODERATE https://git.moodle.org/gw?p=moodle.git;a=commit;h=595ef4772d330a20c757635ab090acdcc9b2a2fa
generic_textual MODERATE https://moodle.org/mod/forum/discuss.php?d=264264
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2014-3543
Reference id Reference type URL
http://openwall.com/lists/oss-security/2014/07/21/1
https://api.first.org/data/v1/epss?cve=CVE-2014-3543
https://github.com/moodle/moodle
https://github.com/moodle/moodle/commit/595ef4772d330a20c757635ab090acdcc9b2a2fa
https://git.moodle.org/gw?p=moodle.git;a=commit;h=595ef4772d330a20c757635ab090acdcc9b2a2fa
https://moodle.org/mod/forum/discuss.php?d=264264
https://nvd.nist.gov/vuln/detail/CVE-2014-3543
GHSA-27j2-c838-c3qg https://github.com/advisories/GHSA-27j2-c838-c3qg
No exploits are available.
Exploit Prediction Scoring System (EPSS)
Percentile 0.61534
EPSS Score 0.00427
Published At June 30, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2025-07-01T12:29:02.584842+00:00 GithubOSV Importer Import https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-27j2-c838-c3qg/GHSA-27j2-c838-c3qg.json 36.1.3