Lucene search

[email protected]CVE-2014-0216

HistoryMay 27, 2014 - 12:55 a.m.

CVE-2014-0216

2014-05-2700:55:02

CWE-264

[email protected]

web.nvd.nist.gov

cve-2014-0216

information security

moodle

file access

remote attack

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

5.8 Medium

AI Score

Confidence

Low

0.003 Low

EPSS

Percentile

69.1%

JSON

The My Home implementation in the block_html_pluginfile function in blocks/html/lib.php in Moodle through 2.3.11, 2.4.x before 2.4.10, 2.5.x before 2.5.6, and 2.6.x before 2.6.3 does not properly restrict file access, which allows remote attackers to obtain sensitive information by visiting an HTML block.

Affected configurations

NVD

Node

moodlemoodleRange≤2.3.11

moodlemoodleMatch2.0.0

moodlemoodleMatch2.0.1

moodlemoodleMatch2.0.2

moodlemoodleMatch2.0.3

moodlemoodleMatch2.0.4

moodlemoodleMatch2.0.5

moodlemoodleMatch2.0.6

moodlemoodleMatch2.0.7

moodlemoodleMatch2.0.8

moodlemoodleMatch2.0.9

moodlemoodleMatch2.1.0

moodlemoodleMatch2.1.1

moodlemoodleMatch2.1.2

moodlemoodleMatch2.1.3

moodlemoodleMatch2.1.4

moodlemoodleMatch2.1.5

moodlemoodleMatch2.1.6

moodlemoodleMatch2.1.7

moodlemoodleMatch2.1.8

moodlemoodleMatch2.1.9

moodlemoodleMatch2.1.10

moodlemoodleMatch2.2.0

moodlemoodleMatch2.2.1

moodlemoodleMatch2.2.2

moodlemoodleMatch2.2.3

moodlemoodleMatch2.2.4

moodlemoodleMatch2.2.5

moodlemoodleMatch2.2.6

moodlemoodleMatch2.2.7

moodlemoodleMatch2.2.8

moodlemoodleMatch2.2.9

moodlemoodleMatch2.2.10

moodlemoodleMatch2.2.11

moodlemoodleMatch2.3.0

moodlemoodleMatch2.3.1

moodlemoodleMatch2.3.2

moodlemoodleMatch2.3.3

moodlemoodleMatch2.3.4

moodlemoodleMatch2.3.5

moodlemoodleMatch2.3.6

moodlemoodleMatch2.3.7

moodlemoodleMatch2.3.8

moodlemoodleMatch2.3.9

moodlemoodleMatch2.3.10

moodlemoodleMatch2.4.0

moodlemoodleMatch2.4.1

moodlemoodleMatch2.4.2

moodlemoodleMatch2.4.3

moodlemoodleMatch2.4.4

moodlemoodleMatch2.4.5

moodlemoodleMatch2.4.6

moodlemoodleMatch2.4.7

moodlemoodleMatch2.4.8

moodlemoodleMatch2.4.9

moodlemoodleMatch2.5.0

moodlemoodleMatch2.5.1

moodlemoodleMatch2.5.2

moodlemoodleMatch2.5.3

moodlemoodleMatch2.5.4

moodlemoodleMatch2.5.5

moodlemoodleMatch2.6.0

moodlemoodleMatch2.6.1

moodlemoodleMatch2.6.2

CPENameOperatorVersion
moodle:moodlemoodlele2.3.11
moodle:moodlemoodleeq2.0.0
moodle:moodlemoodleeq2.0.1
moodle:moodlemoodleeq2.0.2
moodle:moodlemoodleeq2.0.3
moodle:moodlemoodleeq2.0.4
moodle:moodlemoodleeq2.0.5
moodle:moodlemoodleeq2.0.6
moodle:moodlemoodleeq2.0.7
moodle:moodlemoodleeq2.0.8

CPE	Name	Operator	Version
moodle:moodle	moodle	le	2.3.11
moodle:moodle	moodle	eq	2.0.0
moodle:moodle	moodle	eq	2.0.1
moodle:moodle	moodle	eq	2.0.2
moodle:moodle	moodle	eq	2.0.3
moodle:moodle	moodle	eq	2.0.4
moodle:moodle	moodle	eq	2.0.5
moodle:moodle	moodle	eq	2.0.6
moodle:moodle	moodle	eq	2.0.7
moodle:moodle	moodle	eq	2.0.8