CVE-2015-2267: Moodle allows attackers to extract archives to arbitrary directories
Summary
CVE-2015-2267: Moodle allows attackers to extract archives to arbitrary directories. Affects moodle/moodle across 3 version ranges.
< 2.6.9
>= 2.7.0, < 2.7.6
>= 2.8.0, < 2.8.4
Fixed in 2.6.9, 2.7.6 or 2.8.4, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning management system (LMS) used by educational institutions to create and deliver online courses. It provides a platform for educators to create interactive learning environments and engage with students. Moodle is written in PHP and utilizes a modular architecture, allowing for easy customization and extension through plugins. However, a vulnerability has been discovered in Moodle versions 2.5.9 through 2.8.4 that allows remote authenticated users to bypass access restrictions and extract archives to arbitrary directories.
Vulnerability Detail
The vulnerability, identified as CVE-2015-2267, exists in the 'mdeploy.php' file in Moodle. This file is responsible for handling the extraction of archives. By manipulating the 'dataroot' value, remote authenticated users can bypass intended access restrictions and extract archives to arbitrary directories. This can lead to unauthorized access to sensitive files and potentially compromise the integrity and confidentiality of the Moodle installation. The vulnerability has a moderate severity rating and has been reviewed by GitHub.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.6.92.6.9composer require moodle/moodle:2.6.9 -
>= 2.7.0, < 2.7.62.7.6composer require moodle/moodle:2.7.6 -
>= 2.8.0, < 2.8.42.8.4composer require moodle/moodle:2.8.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. Users are advised to apply the fix by upgrading to the fixed versions as mentioned in the 'how_to_fix' section.
Conclusion
In conclusion, Moodle versions 2.5.9 through 2.8.4 are vulnerable to an issue that allows remote authenticated users to extract archives to arbitrary directories. This can result in unauthorized access to sensitive files and compromise the integrity and confidentiality of the Moodle installation. Users are advised to upgrade to the respective fixed versions mentioned in the 'how_to_fix' section to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for moodle/moodle →
FAQ
Moodle is an open-source learning management system (LMS) used by educational institutions to create and deliver online courses.
The vulnerability allows remote authenticated users to extract archives to arbitrary directories, potentially leading to unauthorized access to sensitive files and compromising the integrity and confidentiality of the Moodle installation.
To fix this vulnerability, users should upgrade to the respective fixed versions of Moodle as mentioned in the 'how_to_fix' section.
There is no specific workaround mentioned for this vulnerability. Upgrading to the fixed versions is the recommended solution.
The vulnerability has a moderate severity rating.
References
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
