Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [day] [month] [year] [list]
Date: Mon, 9 Feb 2015 10:55:49 +0800
From: Marina Glancy <>
Subject: Moodle security issue made public

Hi Kurt, we have still waited for a week after the release with the
announcing of the security issue this time but we are actively
discussing the change of process starting from the next release.

The following security notifications have now been made public. Thanks
to OSS members for their cooperation. It also looks like OSS has
accidentally issued us another identifier: CVE-2015-1493. I'm letting
you know that I have never used it in our announcements

MSA-15-0009: Directory Traversal Attack possible through some files serving JS

Description:       Parameter "file" passed to scripts serving JS was not
                   always cleaned from including "../" in the path, allowing
                   to read files located outside of moodle directory. All OS
                   are affected but especially vulnerable are Windows servers
Issue summary:     Preauthenticated Local File Disclosure
Severity/Risk:     Serious
Versions affected: 2.8 to 2.8.2, 2.7 to 2.7.4, 2.6 to 2.6.7 and earlier
                   unsupported versions
Versions fixed:    2.8.3, 2.7.5 and 2.6.8
Reported by:       Emiel Florijn
Issue no.:         MDL-48980 and MDL-48990
Workaround:        Prevent access to URLs containing "../" or "..\" in web
                   server configuration
CVE identifier:    CVE-2015-0246
Changes (master):

Marina Glancy
Development Process Manager
+61894674167 |
The world's open source learning platform

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.