CVE-2020-25630 - NVD | ByteOS Network

NVD Vulnerability Details :

CVE-2020-25630

Analyzed

More Info Official Page

Source-secalert@redhat.com

Published At-08 Dec, 2020 | 01:15

Updated At-08 Dec, 2020 | 15:43

A vulnerability was found in Moodle where the decompressed size of zip files was not checked against available user quota before unzipping them, which could lead to a denial of service risk. This affects versions 3.9 to 3.9.1, 3.8 to 3.8.4, 3.7 to 3.7.7, 3.5 to 3.5.13 and earlier unsupported versions. Fixed in 3.9.2, 3.8.5, 3.7.8 and 3.5.14.

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary	2.0	5.0	MEDIUM	AV:N/AC:L/Au:N/C:N/I:N/A:P

Type: Primary

Version: 3.1

Base score: 7.5

Base severity: HIGH

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Type: Primary

Version: 2.0

Base score: 5.0

Base severity: MEDIUM

Vector:

AV:N/AC:L/Au:N/C:N/I:N/A:P

CPE Matches

>>moodle>>Versions from 3.5.0(inclusive) to 3.5.14(exclusive)

cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*

>>moodle>>Versions from 3.7.0(inclusive) to 3.7.8(exclusive)

cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*

>>moodle>>Versions from 3.8.0(inclusive) to 3.8.5(exclusive)

cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*

>>moodle>>Versions from 3.9.0(inclusive) to 3.9.2(exclusive)

cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-400	Primary	secalert@redhat.com

CWE ID: CWE-400

Type: Primary

Source: secalert@redhat.com

References

Hyperlink	Source	Resource
https://moodle.org/mod/forum/discuss.php?d=410842	secalert@redhat.com	Patch Vendor Advisory

Hyperlink: https://moodle.org/mod/forum/discuss.php?d=410842

Source: secalert@redhat.com

Resource:

Patch

Vendor Advisory