CVE-2014-7848: Moodle allows attacks to obtain sensitive information
lib/phpunit/bootstrap.php in Moodle 2.6.x before 2.6.6 and 2.7.x before 2.7.3 allows remote attackers to obtain sensitive information via a direct request, which reveals the full path in an error message.
Other sources
Moodle allows attacks to obtain sensitive information
— Packagist
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 2.7.3 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 2.6.6
Event History
Frequently Asked Questions
What is the severity of CVE-2014-7848?
CVE-2014-7848 is classified as a medium severity vulnerability due to its potential to expose sensitive information.
How do I fix CVE-2014-7848?
To resolve CVE-2014-7848, upgrade Moodle to version 2.6.6 or 2.7.3 or later.
What versions of Moodle are affected by CVE-2014-7848?
CVE-2014-7848 affects Moodle versions 2.6.x before 2.6.6 and 2.7.x before 2.7.3.
What kind of information can be leaked due to CVE-2014-7848?
CVE-2014-7848 can potentially leak sensitive information, including the full file path in error messages.
Is there a patch available for CVE-2014-7848?
Yes, the fix for CVE-2014-7848 is included in the Moodle versions 2.6.6 and 2.7.3.