PT-2018-10163 · Moodle · Moodle

Les Bell · Publicado 2018-07-10 · Atualizado 2022-05-13 · CVE-2018-10891

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Moodle versions prior to 3.5.1 Moodle versions prior to 3.4.4 Moodle versions prior to 3.3.7 Moodle versions prior to 3.1.13

Description A flaw was found in the software. When a quiz question bank is imported, it is possible for the question preview to execute JavaScript written into the question bank.

Recommendations For versions prior to 3.5.1, update to version 3.5.1 or later. For versions prior to 3.4.4, update to version 3.4.4 or later. For versions prior to 3.3.7, update to version 3.3.7 or later. For versions prior to 3.1.13, update to version 3.1.13 or later.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2018-10891

GHSA-P7V9-GJRH-563X

Produtos afetados

Moodle

Referências · 12

• https://github.com/moodle/moodle · Nota
• https://github.com/moodle/moodle/commit/0b18d0c960c27994dd9870d286f2da3fa5868c06 · Nota
• https://cve.org/CVERecord?id=CVE-2018-10891 · Nota de Segurança
• https://ubuntu.com/security/CVE-2018-10891 · Aviso do Fabricante
• http://securityfocus.com/bid/104739 · Nota
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-10891 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-10891 · Nota de Segurança
• https://web.archive.org/web/20210124185945/https://securityfocus.com/bid/104739 · Nota
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10891 · Nota
• https://moodle.org/mod/forum/discuss.php?d=373371 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-p7v9-gjrh-563x · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2018-10891 · Aviso do Fabricante