VDB
CVE-2014-0216
CVE-2014-0216
PUBLISHED
CVSS 5 MEDIUM
Moodle does not properly restrict file access
Reported by redhat · Published May 27, 2014
The My Home implementation in the block_html_pluginfile function in blocks/html/lib.php in Moodle through 2.3.11, 2.4.x before 2.4.10, 2.5.x before 2.5.6, and 2.6.x before 2.6.3 does not properly restrict file access, which allows remote attackers to obtain sensitive information by visiting an HTML block.
Risk scores
CVSS 2.0
5
Affected products
| Vendor | Product | Versions |
|---|---|---|
| n/a | n/a | n/a |
| n/a | n/a | * |
| moodle | moodle | 0, 2.5.0, 2.6.0 |
Timeline
- May 19, 2014 CVE Published
- Feb 4, 2022 EPSS Score (30 in total, the first dated here)
- Mar 17, 2026 Security Advisory
- Oct 22, 2026 Coalition ESS Score
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2014-0216
vulnetix vdb fixes CVE-2014-0216Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2014-0216/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart
References
- x_refsource_CONFIRM
- x_refsource_CONFIRM
- [oss-security] 20140519 Moodle security notifications public mailing-listx_refsource_MLIST
- https://nvd.nist.gov/vuln/detail/CVE-2014-0216 advisory
- https://github.com/advisories/GHSA-8rc7-4qfv-4484 advisory
- https://github.com/moodle/moodle/commit/40ad22fdd0d9ed569b2ad0ff6ad02814bfa014b8 fix
- https://github.com/moodle/moodle/commit/568514ee7f7e994f61e7a44356fe89d0dd18c157 fix
- https://github.com/moodle/moodle/commit/7b9acc77efe06f7be7070032b05c3159e0a6d415 fix
- https://github.com/moodle/moodle/commit/b04bf988ef47f8fa65dd08ce936ecb774d5d76bd fix