Description

mod/lti/service.php in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allows remote attackers to read arbitrary files via an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

Remediation

References

CVE-2014-3542

Related Vulnerabilities

WordPress Plugin Wise Agent Lead Capture Forms Cross-Site Scripting (1.0)

Oracle Database Server CVE-2011-3525 Vulnerability (CVE-2011-3525)

WordPress Plugin Zingiri Web Shop 'abspath' Parameter Remote File Include (2.4.6)

b2evolution Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2017-5494)

PHP Improper Link Resolution Before File Access ('Link Following') Vulnerability (CVE-2011-0754)

Severity

Medium

Classification

CVE-2014-3542 CWE-200

Tags

Missing Update Known Vulnerabilities