Description

Directory traversal vulnerability in the min_get_slash_argument function in lib/configonlylib.php in Moodle through 2.5.9, 2.6.x before 2.6.8, 2.7.x before 2.7.5, and 2.8.x before 2.8.3 allows remote authenticated users to read arbitrary files via a .. (dot dot) in the file parameter, as demonstrated by reading PHP scripts.

Remediation

References

CVE-2015-1493

Related Vulnerabilities

WebLogic CVE-2022-21548 Vulnerability (CVE-2022-21548)

ReviveAdserver Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2013-7149)

PHP Other Vulnerability (CVE-2005-3388)

WordPress Plugin Poll Maker SQL Injection (3.4.1)

Liferay Portal Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2023-42627)

Severity

Medium

Classification

CVE-2015-1493 CWE-22

Tags

Missing Update Known Vulnerabilities