CVE-2015-1493: Moodle directory traversal vulnerability
Directory traversal vulnerability in the mingetslashargument function in lib/configonlylib.php in Moodle through 2.5.9, 2.6.x before 2.6.8, 2.7.x before 2.7.5, and 2.8.x before 2.8.3 allows remote authenticated users to read arbitrary files via a .. (dot dot) in the file parameter, as demonstrated by reading PHP scripts.
Other sources
Moodle directory traversal vulnerability
— Packagist
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 2.8.3 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 2.7.5 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 2.6.8 - Upgrade
Upgrade
Moodleto a version that resolves this vulnerability.Fixed in 2.8.3
Event History
Frequently Asked Questions
What is the severity of CVE-2015-1493?
CVE-2015-1493 has a medium severity rating due to the potential for unauthorized file access by authenticated users.
How do I fix CVE-2015-1493?
To fix CVE-2015-1493, upgrade Moodle to version 2.8.3, 2.7.5, or 2.6.8 or later.
Which versions of Moodle are affected by CVE-2015-1493?
Moodle versions from 2.5.0 through 2.8.2 are affected by CVE-2015-1493.
What type of vulnerability is CVE-2015-1493?
CVE-2015-1493 is categorized as a directory traversal vulnerability.
Can CVE-2015-1493 be exploited remotely?
Yes, CVE-2015-1493 allows remote authenticated users to exploit the vulnerability to read arbitrary files.