{"id":"CVE-2014-0216","aliases":["EUVD-2022-3226","GHSA-8rc7-4qfv-4484","MGASA-2014-0230"],"status":"published","title":"Moodle does not properly restrict file access","description":"The My Home implementation in the block_html_pluginfile function in blocks/html/lib.php in Moodle through 2.3.11, 2.4.x before 2.4.10, 2.5.x before 2.5.6, and 2.6.x before 2.6.3 does not properly restrict file access, which allows remote attackers to obtain sensitive information by visiting an HTML block.","severity":{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.02118,"percentile":0.81973,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-264"],"published":"2014-05-19T18:46:11Z","modified":"2026-06-17T00:02:32Z","fixes":[{"ecosystem":"Packagist","package":"moodle/moodle","fixed_in":["2.4.10","2.5.6","2.6.3"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"moodle/moodle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.10"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"moodle/moodle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.5.0"},{"fixed":"2.5.6"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"moodle/moodle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.6.0"},{"fixed":"2.6.3"}]}]},{"source":"osv","ecosystem":"Packagist","package":"moodle/moodle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.10"}]}],"versions":["v2.3.10","v2.3.11","v2.3.4","v2.3.5","v2.3.6","v2.3.7","v2.3.8","v2.3.9","v2.4.0","v2.4.0-rc1","v2.4.1","v2.4.2","v2.4.3","v2.4.4","v2.4.5","v2.4.6","v2.4.7","v2.4.8","v2.4.9"]},{"source":"osv","ecosystem":"Packagist","package":"moodle/moodle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.5.0"},{"fixed":"2.5.6"}]}],"versions":["v2.5.0","v2.5.1","v2.5.2","v2.5.3","v2.5.4","v2.5.5"]},{"source":"osv","ecosystem":"Packagist","package":"moodle/moodle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.6.0"},{"fixed":"2.6.3"}]}],"versions":["v2.6.0","v2.6.1","v2.6.2"]},{"source":"osv","ecosystem":"Mageia:3","package":"moodle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.3-1.mga3"}]}],"bundled":5},{"source":"osv","ecosystem":"Mageia:4","package":"moodle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.3-1.mga4"}]}],"bundled":5}],"products":[{"vendor":"moodle","product":"moodle"}],"references":[{"url":"https://moodle.org/mod/forum/discuss.php?d=260364","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","web"]},{"url":"http://git.moodle.org/gw?p=moodle.git\u0026a=search\u0026h=HEAD\u0026st=commit\u0026s=MDL-43877","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://openwall.com/lists/oss-security/2014/05/19/1","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-0216","tags":["advisory"]},{"url":"https://github.com/moodle/moodle/commit/40ad22fdd0d9ed569b2ad0ff6ad02814bfa014b8","tags":["web"]},{"url":"https://github.com/moodle/moodle/commit/568514ee7f7e994f61e7a44356fe89d0dd18c157","tags":["web"]},{"url":"https://github.com/moodle/moodle/commit/7b9acc77efe06f7be7070032b05c3159e0a6d415","tags":["web"]},{"url":"https://github.com/moodle/moodle/commit/b04bf988ef47f8fa65dd08ce936ecb774d5d76bd","tags":["web"]},{"url":"https://github.com/advisories/GHSA-8rc7-4qfv-4484"},{"url":"https://github.com/moodle/moodle","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2014-0230.html","tags":["advisory"]},{"url":"https://moodle.org/mod/forum/discuss.php?d=260361","tags":["web"]},{"url":"https://moodle.org/mod/forum/discuss.php?d=260362","tags":["web"]},{"url":"https://moodle.org/mod/forum/discuss.php?d=260363","tags":["web"]},{"url":"https://moodle.org/mod/forum/discuss.php?d=260366","tags":["web"]},{"url":"http://docs.moodle.org/dev/Moodle_2.4.10_release_notes","tags":["web"]},{"url":"http://docs.moodle.org/dev/Moodle_2.6.3_release_notes","tags":["web"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=13369","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2014-0216","description":"The My Home implementation in the block_html_pluginfile function in blocks/html/lib.php in Moodle through 2.3.11, 2.4.x before 2.4.10, 2.5.x before 2.5.6, and 2.6.x before 2.6.3 does not properly restrict file access, which allows remote attackers to obtain sensitive information by visiting an HTML block.","status":"published","published":"2014-05-27T00:00:00Z","modified":"2024-08-06T09:05:39.294Z","updated_at":"2026-11-02T14:33:47.741012Z"}],"euvd":[{"id":"EUVD-2022-3226","description":"The My Home implementation in the block_html_pluginfile function in blocks/html/lib.php in Moodle through 2.3.11, 2.4.x before 2.4.10, 2.5.x before 2.5.6, and 2.6.x before 2.6.3 does not properly restrict file access, which allows remote attackers to obtain sensitive information by visiting an HTML block.","status":"published","published":"2014-05-27T00:00:00Z","modified":"2024-08-06T09:05:39Z","updated_at":"2026-11-03T01:57:22.035163Z"}],"ghsa":[{"id":"GHSA-8rc7-4qfv-4484","title":"Moodle does not properly restrict file access","description":"The My Home implementation in the block_html_pluginfile function in blocks/html/lib.php in Moodle through 2.3.11, 2.4.x before 2.4.10, 2.5.x before 2.5.6, and 2.6.x before 2.6.3 does not properly restrict file access, which allows remote attackers to obtain sensitive information by visiting an HTML block.","status":"published","published":"2022-05-13T01:12:51Z","modified":"2024-01-24T16:21:07Z","updated_at":"2026-11-02T14:37:32.302254Z"}],"nvd":[{"id":"CVE-2014-0216","description":"The My Home implementation in the block_html_pluginfile function in blocks/html/lib.php in Moodle through 2.3.11, 2.4.x before 2.4.10, 2.5.x before 2.5.6, and 2.6.x before 2.6.3 does not properly restrict file access, which allows remote attackers to obtain sensitive information by visiting an HTML block.","status":"published","published":"2014-05-27T00:55:02.557Z","modified":"2026-06-17T00:02:32.167Z","cvss":[{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-264"],"updated_at":"2026-11-02T14:02:54.464139Z"}],"osv":[{"id":"GHSA-8rc7-4qfv-4484","title":"Moodle does not properly restrict file access","description":"The My Home implementation in the block_html_pluginfile function in blocks/html/lib.php in Moodle through 2.3.11, 2.4.x before 2.4.10, 2.5.x before 2.5.6, and 2.6.x before 2.6.3 does not properly restrict file access, which allows remote attackers to obtain sensitive information by visiting an HTML block.","status":"published","published":"2022-05-13T01:12:51Z","modified":"2024-12-07T05:49:25.468337Z","updated_at":"2026-11-02T15:46:42.78452Z"},{"id":"MGASA-2014-0230","title":"Updated moodle packages fix multiple vulnerabilities","description":"Updated moodle package fixes security vulnerabilities:\n\nIn Moodle before 2.6.3, Session checking was not being performed correctly\nin Assignment's quick-grading, allowing forged requests to be made\nunknowingly by authenticated users (CVE-2014-0213).\n\nIn Moodle before 2.6.3, MoodleMobile web service tokens, created\nautomatically in login/token.php, were not expiring and were valid forever\n(CVE-2014-0214).\n\nIn Moodle before 2.6.3, Some student details, including identities, were\nincluded in assignment marking pages and would have been revealed to\nscreen readers or through code inspection (CVE-2014-0215).\n\nIn Moodle before 2.6.3, Access to files linked on HTML blocks on the My\nhome page was not being checked in the correct context, allowing access to\nunauthenticated users (CVE-2014-0216).\n\nIn Moodle before 2.6.3, There was a lack of filtering in the URL\ndownloader repository that could have been exploited for XSS\n(CVE-2014-0218).\n\nThe 2.4 branch of Moodle will no longer be supported as of approximately\nJune 2014, so the Moodle package has been upgraded to version 2.6.3 to fix\nthese issues.\n","status":"published","published":"2014-05-19T18:46:11Z","modified":"2026-04-16T06:26:26.610825652Z","updated_at":"2026-11-02T15:49:39.121227Z"}]}}