Description

The My Home implementation in the block_html_pluginfile function in blocks/html/lib.php in Moodle through 2.3.11, 2.4.x before 2.4.10, 2.5.x before 2.5.6, and 2.6.x before 2.6.3 does not properly restrict file access, which allows remote attackers to obtain sensitive information by visiting an HTML block.

Remediation

References

CVE-2014-0216

Related Vulnerabilities

Drupal Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2013-6388)

WordPress Plugin Blog2Social:Social Media Auto Post & Scheduler PHP Object Injection (5.0.0)

WordPress Plugin Peter's Math Anti-Spam Audio CAPTCHA Security Bypass (0.1.6)

MySQL CVE-2021-1998 Vulnerability (CVE-2021-1998)

UAParser.js Inefficient Regular Expression Complexity Vulnerability (CVE-2022-25927)

Severity

Medium

Tags

Missing Update Known Vulnerabilities CWE-264 CVE-2014-0216