CVE-2020-25630: High severity moodle vulnerability
A vulnerability was found in Moodle where the decompressed size of zip files was not checked against available user quota before unzipping them, which could lead to a denial of service risk. This affects versions 3.9 to 3.9.1, 3.8 to 3.8.4, 3.7 to 3.7.7, 3.5 to 3.5.13 and earlier unsupported versions. Fixed in 3.9.2, 3.8.5, 3.7.8 and 3.5.14.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2020-25630?
CVE-2020-25630 is a vulnerability in Moodle where the decompressed size of zip files was not checked against available user quota before unzipping them, leading to a denial of service risk.
Which versions of Moodle are affected by CVE-2020-25630?
Versions 3.9 to 3.9.1, 3.8 to 3.8.4, 3.7 to 3.7.7, 3.5 to 3.5.13, and earlier unsupported versions of Moodle are affected by CVE-2020-25630.
What is the severity of CVE-2020-25630?
CVE-2020-25630 has a severity keyword of 'high' and a severity value of 7.5.
How does CVE-2020-25630 impact Moodle?
CVE-2020-25630 can lead to a denial of service risk in Moodle.
How can I fix CVE-2020-25630?
To fix CVE-2020-25630, update to a version of Moodle that is not affected by the vulnerability.