CVEvulnerability

CVE-2018-1137

8.1 HIGH Published 2018-05-25 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2018-05-25
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.0 ([email protected])
8.1 HIGH — CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
CVSS 2.0 ([email protected])
5.5 MEDIUM — AV:N/AC:L/Au:S/C:N/I:P/A:P
Weaknesses
CWE-20

Description

An issue was discovered in Moodle 3.x. By substituting URLs in portfolios, users can instantiate any class. This can also be exploited by users who are logged in as guests to create a DDoS attack.

Affected configurations

• moodle moodle (>= 3.1.0 <= 3.1.11) • moodle moodle (>= 3.2.0 <= 3.2.8) • moodle moodle (>= 3.3.0 <= 3.3.5) • moodle moodle (>= 3.4.0 <= 3.4.2)

Related

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References