CVE-2015-2267: Medium severity moodle vulnerability
Published Jun 1, 2015
·Updated
mdeploy.php in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4 allows remote authenticated users to bypass intended access restrictions and extract archives to arbitrary directories via a crafted dataroot value.
Affected Software
32 affected componentsFixes available
composer/moodle/moodle>=2.8.0<2.8.4
2.8.4
composer/moodle/moodle>=2.7.0<2.7.6
2.7.6
composer/moodle/moodle<2.6.9
2.6.9
Moodle moodle<=2.5.9
Moodle moodle=2.5.0
Moodle moodle=2.5.1
Moodle moodle=2.5.2
Moodle moodle=2.5.3
Moodle moodle=2.5.4
Moodle moodle=2.5.5
Moodle moodle=2.5.6
Moodle moodle=2.5.7
Moodle moodle=2.5.8
Moodle moodle=2.6.0
Moodle moodle=2.6.1
Moodle moodle=2.6.2
Moodle moodle=2.6.3
Moodle moodle=2.6.4
Moodle moodle=2.6.5
Moodle moodle=2.6.6
Moodle moodle=2.6.7
Moodle moodle=2.6.8
Moodle moodle=2.7.0
Moodle moodle=2.7.1
Moodle moodle=2.7.2
Moodle moodle=2.7.3
Moodle moodle=2.7.4
Moodle moodle=2.7.5
Moodle moodle=2.8.0
Moodle moodle=2.8.1
Moodle moodle=2.8.2
Moodle moodle=2.8.3
Event History
Jun 1, 2015
CVE Published
via MITRE·07:00 PM
Data Sourced
via MITRE·07:00 PM
Description
May 13, 2022
Advisory Published
via GitHub·01:12 AM
Frequently Asked Questions
1
What is the severity of CVE-2015-2267?
CVE-2015-2267 is classified as a high severity vulnerability allowing unauthorized access to the file system.
2
How do I fix CVE-2015-2267?
To fix CVE-2015-2267, upgrade to Moodle version 2.6.9, 2.7.6, or 2.8.4 or later.
3
What are the affected versions by CVE-2015-2267?
Affected versions include Moodle 2.5.0 to 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4.
4
Who can exploit CVE-2015-2267?
Remote authenticated users can exploit CVE-2015-2267 to bypass access restrictions.
5
What type of vulnerability is CVE-2015-2267?
CVE-2015-2267 is a vulnerability that allows the extraction of archives to arbitrary directories.