Improper access control in Moodle - CVE-2015-2267
Published: June 1, 2015 / Updated: August 9, 2020
Vulnerability identifier: #VU40744
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2015-2267
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote #AU# to manipulate data.
mdeploy.php in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4 allows remote authenticated users to bypass intended access restrictions and extract archives to arbitrary directories via a crafted dataroot value.
Affected software
Moodle
Fedora
moodle
Fedora
moodle
How to mitigate CVE-2015-2267
Install update from vendor's website.
moodle - addressed in versions 2.6.10-1.el6, 2.7.7-1.fc21, 2.8.5-1.fc22