Miembros de
Boletines de Vulnerabilidades |
MSA-21-0005: Arbitrary PHP code execution by site admins via Shibboleth configuration |
|
| Software afectado | PHP |
|
by Michael Hawkins. It was possible for site administrators to execute arbitrary PHP scripts via a PHP include used during Shibboleth authentication.Severity/Risk:SeriousVersions affected:3.10, 3.9 to 3.9.3, 3.8 to 3.8.6, 3.5 to 3.5.15 and earlier unsupported versionsVersions fixed:3.10.1, 3.9.4, 3.8.7 and 3.5.16Reported by:Frédéric MassartWorkaround:Harcode preventexecpath to true in config.php, which prevents site administrators setting some executable paths via the UI. See More info: https://moodle.org/mod/forum/discuss.php?d=417171&parent=1680847 |
|
