PT-2018-10497 · Moodle · Moodle

Brendan Cox · Publicado 2018-05-25 · Atualizado 2022-05-13 · CVE-2018-1134

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Moodle versions 3.x

Description An issue allows students who submitted assignments and exported them to portfolios to download any stored Moodle file by changing the download URL.

Recommendations For Moodle versions 3.x, update to a version where this issue is fixed, or as a temporary workaround, consider restricting access to the portfolio export feature to prevent unauthorized file downloads.

Correção

Improper Privilege Management

Enumeração de Fraquezas

CWE-269

Identificadores relacionados

CVE-2018-1134

GHSA-XJX9-7C29-PWMM

Produtos afetados

Moodle

Referências · 9

• https://github.com/moodle/moodle · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-1134 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-xjx9-7c29-pwmm · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2018-1134 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2018-1134 · Aviso do Fabricante
• https://moodle.org/mod/forum/discuss.php?d=371200 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-1134 · Aviso do Fabricante
• http://securityfocus.com/bid/104307 · Nota
• https://cve.org/CVERecord?id=CVE-2018-1134 · Nota de Segurança