GHSA-j8wr-7xxj-c2fr

Moodle Private files uploaded via incoming mail processing could bypass quota restrictions

En bref

Publiée: 2022-05-24 16:48 UTC
Mise à jour: 2024-04-23 23:58 UTC
CVE: CVE-2019-10134
CVSS_V3: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L

Description

A flaw was found in Moodle before 3.7, 3.6.4, 3.5.6, 3.4.9 and 3.1.18. The size of users' private file uploads via email were not correctly checked, so their quota allowance could be exceeded.

Paquets affectés

Paquet	Versions
Packagist · moodle/moodle	introduced 3.6, fixed 3.6.4
Packagist · moodle/moodle	introduced 3.5, fixed 3.5.6
Packagist · moodle/moodle	introduced 3.4, fixed 3.4.9
Packagist · moodle/moodle	introduced 3.1, fixed 3.1.18

Références

https://nvd.nist.gov/vuln/detail/CVE-2019-10134 ADVISORY
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10134 WEB
https://github.com/moodle/moodle PACKAGE
https://moodle.org/mod/forum/discuss.php?d=386524 WEB

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — GitHub Advisory Database