CVE-2020-25630

HIGH

Moodle 3.5.0-3.5.13, 3.7.0-3.7.7, 3.8.0-3.8.4, 3.9.0-3.9.1 - Denial of Service via Unchecked Zip File Decompression

Title source: llm

Description

A vulnerability was found in Moodle where the decompressed size of zip files was not checked against available user quota before unzipping them, which could lead to a denial of service risk. This affects versions 3.9 to 3.9.1, 3.8 to 3.8.4, 3.7 to 3.7.7, 3.5 to 3.5.13 and earlier unsupported versions. Fixed in 3.9.2, 3.8.5, 3.7.8 and 3.5.14.

References (1)

Core 1

Core References

Patch, Vendor Advisory x_refsource_confirm

https://moodle.org/mod/forum/discuss.php?d=410842

Scores

CVSS v3 7.5

EPSS 0.0050

EPSS Percentile 66.0%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Details

CWE

CWE-400

Status published

Products (2)

moodle/moodle 3.5.0 - 3.5.14

moodle/moodle 3.9 - 3.9.2Packagist

Published Dec 08, 2020

Tracked Since Feb 18, 2026