Description

Directory traversal vulnerability in the min_get_slash_argument function in lib/configonlylib.php in Moodle through 2.5.9, 2.6.x before 2.6.8, 2.7.x before 2.7.5, and 2.8.x before 2.8.3 allows remote authenticated users to read arbitrary files via a .. (dot dot) in the file parameter, as demonstrated by reading PHP scripts.

Remediation

References

CVE-2015-1493

Related Vulnerabilities

OpenSSL NULL Pointer Dereference Vulnerability (CVE-2023-0216)

WordPress Plugin Plug your WooCommerce into the largest catalog of customized print products from Helloprint Cross-Site Scripting (1.4.6)

CKEditor Unrestricted Upload of File with Dangerous Type Vulnerability (CVE-2023-31541)

WordPress 4.2.x Cross-Site Scripting Vulnerability (4.2 - 4.2.7)

WordPress Plugin CM Pop-Up banners for WordPress SQL Injection (1.5.10)

Severity

Medium

Classification

CVE-2015-1493 CWE-22

Tags

Missing Update Known Vulnerabilities