Description

mod/lti/service.php in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allows remote attackers to read arbitrary files via an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

Remediation

References

CVE-2014-3542

Related Vulnerabilities

Python Untrusted Search Path Vulnerability (CVE-2023-41105)

Atlassian Jira Authorization Bypass Through User-Controlled Key Vulnerability (CVE-2020-14174)

WordPress Plugin Form Maker by 10Web-Mobile-Friendly Drag & Drop Contact Form Builder Unspecified Vulnerability (1.6.5)

Oracle Database Server CVE-2014-6545 Vulnerability (CVE-2014-6545)

WordPress Plugin WHIZZ Cross-Site Scripting (1.0.7)

Severity

Medium

Classification

CVE-2014-3542 CWE-200

Tags

Missing Update Known Vulnerabilities