GitHub Advisoryadvisory · Packagist

GHSA-vxqh-mx28-7ghw Moodle Portfolio script allows instantiation of class chosen by user

HIGH Published 2022-05-14 Modified 2024-04-23 Official page ↗
Aliases
CVE-2018-1137
Ecosystem
Packagist
Packages
moodle/moodle
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Weaknesses
CWE-20
Reviewed
2024-04-23

Affected packages

• Packagist moodle/moodle: >= 3.1, < 3.1.12 → fixed in 3.1.12 • Packagist moodle/moodle: >= 3.2, < 3.2.9 → fixed in 3.2.9 • Packagist moodle/moodle: >= 3.3, < 3.3.6 → fixed in 3.3.6 • Packagist moodle/moodle: >= 3.4, < 3.4.3 → fixed in 3.4.3

Description

An issue was discovered in Moodle 3.x. By substituting URLs in portfolios, users can instantiate any class. This can also be exploited by users who are logged in as guests to create a DDoS attack.

Related

Alias · CVE (1)

  • CVE-2018-1137 An issue was discovered in Moodle 3.x. vulnerability

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References