CVE-2014-7848: Infoleak
Published Nov 24, 2014
·Updated
lib/phpunit/bootstrap.php in Moodle 2.6.x before 2.6.6 and 2.7.x before 2.7.3 allows remote attackers to obtain sensitive information via a direct request, which reveals the full path in an error message.
Affected Software
21 affected componentsFixes available
composer/moodle/moodle>=2.7.0<2.7.3
2.7.3
composer/moodle/moodle>=2.6.0<2.6.6
2.6.6
Moodle moodle<=2.4.11
Moodle moodle=2.5.0
Moodle moodle=2.5.1
Moodle moodle=2.5.2
Moodle moodle=2.5.3
Moodle moodle=2.5.4
Moodle moodle=2.5.5
Moodle moodle=2.5.6
Moodle moodle=2.5.7
Moodle moodle=2.5.8
Moodle moodle=2.6.0
Moodle moodle=2.6.1
Moodle moodle=2.6.2
Moodle moodle=2.6.3
Moodle moodle=2.6.4
Moodle moodle=2.6.5
Moodle moodle=2.7.0
Moodle moodle=2.7.1
Moodle moodle=2.7.2
Remediation
Event History
Nov 24, 2014
CVE Published
via MITRE·11:00 AM
Data Sourced
via MITRE·11:00 AM
Description
May 13, 2022
Advisory Published
via GitHub·01:12 AM
Frequently Asked Questions
1
What is the severity of CVE-2014-7848?
CVE-2014-7848 is classified as a medium severity vulnerability due to its potential to expose sensitive information.
2
How do I fix CVE-2014-7848?
To resolve CVE-2014-7848, upgrade Moodle to version 2.6.6 or 2.7.3 or later.
3
What versions of Moodle are affected by CVE-2014-7848?
CVE-2014-7848 affects Moodle versions 2.6.x before 2.6.6 and 2.7.x before 2.7.3.
4
What kind of information can be leaked due to CVE-2014-7848?
CVE-2014-7848 can potentially leak sensitive information, including the full file path in error messages.
5
Is there a patch available for CVE-2014-7848?
Yes, the fix for CVE-2014-7848 is included in the Moodle versions 2.6.6 and 2.7.3.