What is CVE-2020-25630?

CVE-2020-25630 is a high-severity vulnerability in Moodle, classified under Uncontrolled Resource Consumption. CVSS score: 7.5/10. Published 2020-12-08.

How severe is CVE-2020-25630?

High severity. CVSS v3 base score is 7.5 out of 10.

Is CVE-2020-25630 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Resource exhaustion in Moodle

CVE-2020-25630

A vulnerability was found in Moodle where the decompressed size of zip files was not checked against available user quota before unzipping them, which could lead to a denial of service risk. This affects versions 3.9 to 3.9.1, 3.8 to 3.8.4, 3.7 to 3.7.7, 3.5 to 3.5.13 and earlier unsupported versions. Fixed in 3.9.2, 3.8.5, 3.7.8 and 3.5.14.

Vulnerability class: DoS (Denial of Service)

EPSS: 0.013 (68.5th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.

Affected products

Moodle
N/a Moodle — versions 3.9 to 3.9.1, 3.8 to 3.8.4, 3.7 to 3.7.7

Weakness classification (CWE)

CWE-400 — Uncontrolled Resource Consumption

Public proof-of-concept exploits

jev770/badmoodle-scan

References

secalert@redhat.com (x_refsource_CONFIRM, Patch, Vendor Advisory)

Frequently asked questions

What is CVE-2020-25630?: CVE-2020-25630 is a high-severity vulnerability in Moodle, classified under Uncontrolled Resource Consumption. CVSS score: 7.5/10. Published 2020-12-08.
How severe is CVE-2020-25630?: High severity. CVSS v3 base score is 7.5 out of 10.
Is CVE-2020-25630 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.