Permissions, Privileges, and Access Controls in Moodle - CVE-2020-25630
Published: September 21, 2020
Vulnerability identifier: #VU46837
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2020-25630
CWE-ID: CWE-264
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to the decompressed size of zip files is not checked against available user quota before unzipping them in the file picker unzip functionality. A remote attacker trick the victim to unzip a large archive and perform a denial of service (DoS) attack.
Affected software
Moodle
How to mitigate CVE-2020-25630
Install updates from vendor's website.
Moodle - addressed in versions 3.5.14, 3.7.8, 3.8.5, 3.9.2