Moodle vulnerable to PHP object injection attacks
The Repositories component in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allows remote attackers to conduct PHP object injection attacks and execute arbitrary code via serialized data associated with an add-on.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2014-3541US | high7.5 | — | ||
The Repositories component in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allows remote attackers to conduct PHP obje… | ||||
02
references
External citations — patches, advisories, analysis.
- http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-45616WEB
- http://openwall.com/lists/oss-security/2014/07/21/1WEB
- https://github.com/moodle/moodlePACKAGE
- https://github.com/moodle/moodle/commit/3fe105953d14766393e24372806fcf0a2b77c96dWEB
- https://github.com/moodle/moodle/commit/40d52d4067c2ee062a5b16c780753c6f97413894WEB
- https://github.com/moodle/moodle/commit/5c4ef26c39d3106315f74c26cdcca779ba74254cWEB
- https://github.com/moodle/moodle/commit/61961447c29d48e5a494e7c02e653d6ff00551b2WEB
- https://github.com/moodle/moodle/commit/68170f0b01ccaade799c4cab2312ce6a825fb844WEB
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan