Description

The My Home implementation in the block_html_pluginfile function in blocks/html/lib.php in Moodle through 2.3.11, 2.4.x before 2.4.10, 2.5.x before 2.5.6, and 2.6.x before 2.6.3 does not properly restrict file access, which allows remote attackers to obtain sensitive information by visiting an HTML block.

Remediation

References

CVE-2014-0216

Related Vulnerabilities

phpMyFAQ Improper Control of Generation of Code ('Code Injection') Vulnerability (CVE-2023-0788)

WordPress Plugin SpiderCatalog Unspecified Vulnerability (1.6.8)

WordPress Plugin EnvialoSimple:Email Marketing y Newsletters Multiple Cross-Site Scripting Vulnerabilities (1.97)

Moodle Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2013-4522)

Ruby on Rails Resource Management Errors Vulnerability (CVE-2016-0751)

Severity

Medium

Classification

CVE-2014-0216 CWE-264

Tags

Missing Update Known Vulnerabilities