Description

mod/lti/service.php in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allows remote attackers to read arbitrary files via an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

Remediation

References

CVE-2014-3542

Related Vulnerabilities

WordPress Plugin Caldera Forms-More Than Contact Forms Cross-Site Scripting (1.5.4)

Microsoft SQL Server CVE-2023-21528 Vulnerability (CVE-2023-21528)

MySQL CVE-2021-2278 Vulnerability (CVE-2021-2278)

Jenkins Permissions, Privileges, and Access Controls Vulnerability (CVE-2015-5324)

phpMyFAQ Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) Vulnerability (CVE-2023-1758)

Severity

Medium

Classification

CVE-2014-3542 CWE-200

Tags

Missing Update Known Vulnerabilities