Description

mod/lti/service.php in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allows remote attackers to read arbitrary files via an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

Remediation

References

CVE-2014-3542

Related Vulnerabilities

Joomla Incorrect Authorization Vulnerability (CVE-2023-23751)

WordPress 4.9.x PHP Object Injection (4.9 - 4.9.17)

Joomla CVE-2019-12764 Vulnerability (CVE-2019-12764)

Python CVE-2019-16056 Vulnerability (CVE-2019-16056)

MySQL CVE-2019-2630 Vulnerability (CVE-2019-2630)

Severity

Medium

Classification

CVE-2014-3542 CWE-200

Tags

Missing Update Known Vulnerabilities