GHSA-j8wr-7xxj-c2fr

Moodle Private files uploaded via incoming mail processing could bypass quota restrictions

At a glance

Published: 2022-05-24 16:48 UTC
Updated: 2024-04-23 23:58 UTC
CVE: CVE-2019-10134
CVSS_V3: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L

Description

A flaw was found in Moodle before 3.7, 3.6.4, 3.5.6, 3.4.9 and 3.1.18. The size of users' private file uploads via email were not correctly checked, so their quota allowance could be exceeded.

Affected packages

Package	Versions
Packagist · moodle/moodle	introduced 3.6, fixed 3.6.4
Packagist · moodle/moodle	introduced 3.5, fixed 3.5.6
Packagist · moodle/moodle	introduced 3.4, fixed 3.4.9
Packagist · moodle/moodle	introduced 3.1, fixed 3.1.18

References

https://nvd.nist.gov/vuln/detail/CVE-2019-10134 ADVISORY
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10134 WEB
https://github.com/moodle/moodle PACKAGE
https://moodle.org/mod/forum/discuss.php?d=386524 WEB

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — GitHub Advisory Database