PT-2015-1588 · Moodle · Moodle

Frédéric Massart · Publicado 2015-03-18 · Atualizado 2022-05-13 · CVE-2015-2267

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Média

Vetor base

AV:N/AC:L/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Moodle versions 2.5.9 and earlier, 2.6.x before 2.6.9, 2.7.x before 2.7.6, 2.8.x before 2.8.4

Description The issue is related to inadequate access control in the mdeploy.php component of the Moodle learning management system. It allows a remote attacker to bypass existing access restrictions and extract archives to arbitrary directories by crafting a dataroot value.

Recommendations For versions 2.5.9 and earlier, update to a version later than 2.5.9. For versions 2.6.x before 2.6.9, update to version 2.6.9 or later. For versions 2.7.x before 2.7.6, update to version 2.7.6 or later. For versions 2.8.x before 2.8.4, update to version 2.8.4 or later.

Correção

Improper Access Control

Enumeração de Fraquezas

CWE-284

Identificadores relacionados

BDU:2015-10920

CVE-2015-2267

GHSA-CM4R-58PJ-H2PH

MGASA-2015-0110

Produtos afetados

Moodle

Referências · 34

• https://github.com/moodle/moodle · Nota
• https://github.com/moodle/moodle/commit/8d9bdd28e049ca6b6b2a4ab8f142097c2f907df6 · Nota
• https://github.com/moodle/moodle/commit/84f9f60b67e1e20058fbe2afa473607d075aff63 · Nota
• https://github.com/moodle/moodle/commit/12a8fcb5e45c58ee8267ad0472852c2b80a19878 · Nota
• https://github.com/moodle/moodle/commit/83866c3c2a5b1391317172eea0b4f017c6d142d2 · Nota
• https://github.com/moodle/moodle/commit/de169b7944e36d374d55e3f396d90ab2b4303afb · Nota
• https://github.com/moodle/moodle/commit/240e7be7341afa31096fdbf3f242a7966f6237ab · Nota
• https://github.com/moodle/moodle/commit/a47aabc7833d0c88a83791d99a1204742c33f59b · Nota
• https://github.com/moodle/moodle/commit/76da7e9bc88669eab62f83f04639ba356a0b0c5a · Nota
• https://github.com/moodle/moodle/commit/4475f1e478370fb97933127ec60e40f39e285da1 · Nota
• https://github.com/moodle/moodle/commit/c353a6202658f320096a41e94494063393153b7f · Nota
• https://moodle.org/mod/forum/discuss.php?d=307381 · Aviso do Fabricante
• http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-49087 · Nota
• https://cve.org/CVERecord?id=CVE-2015-2267 · Nota de Segurança
• https://ubuntu.com/security/CVE-2015-2267 · Aviso do Fabricante