Description

mdeploy.php in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4 allows remote authenticated users to bypass intended access restrictions and extract archives to arbitrary directories via a crafted dataroot value.

Remediation

References

CVE-2015-2267

Related Vulnerabilities

Oracle Application Server Other Vulnerability (CVE-2005-3451)

Artifactory Improper Input Validation Vulnerability (CVE-2016-6501)

PleskLin Exposure of Resource to Wrong Sphere Vulnerability (CVE-2023-43784)

WordPress Plugin Omni Secure Files 'upload.php' Arbitrary File Upload (0.1.13)

Ruby Out-of-bounds Read Vulnerability (CVE-2022-28739)

Severity

Medium

Classification

CVE-2015-2267 CWE-284

Tags

Missing Update Known Vulnerabilities