GitHub Advisoryadvisory · Packagist

GHSA-vxmv-74rf-vqgp Moodle Portfolio forum caller class allows a user to download any file

MEDIUM Published 2022-05-14 Modified 2024-04-23 Official page ↗
Aliases
CVE-2018-1135
Ecosystem
Packagist
Packages
moodle/moodle
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-200
Reviewed
2024-04-23

Affected packages

• Packagist moodle/moodle: >= 3.1, < 3.1.12 → fixed in 3.1.12 • Packagist moodle/moodle: >= 3.2, < 3.2.9 → fixed in 3.2.9 • Packagist moodle/moodle: >= 3.3, < 3.3.6 → fixed in 3.3.6 • Packagist moodle/moodle: >= 3.4, < 3.4.3 → fixed in 3.4.3

Description

An issue was discovered in Moodle 3.x. Students who posted on forums and exported the posts to portfolios can download any stored Moodle file by changing the download URL.

Related

Alias · CVE (1)

  • CVE-2018-1135 An issue was discovered in Moodle 3.x. vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References