PT-2018-10518 · Moodle · Moodle

Brendan Cox · Publicado 2018-05-25 · Atualizado 2022-05-13 · CVE-2018-1136

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Moodle versions 3.x

Description An issue allows authenticated users to add HTML blocks containing scripts to their Dashboard. Normally, this would not be a security issue since a personal dashboard is only visible to the user. However, through this issue, users can move such blocks to other pages where they can be viewed by other users.

Recommendations For Moodle versions 3.x, restrict the ability of users to move HTML blocks to other pages to minimize the risk of exploitation. Consider disabling the addition of HTML blocks containing scripts to the Dashboard until a fix is available.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2018-1136

GHSA-XHFW-WJJC-4J5H

Produtos afetados

Moodle

Referências · 9

• https://github.com/moodle/moodle · Nota
• https://ubuntu.com/security/CVE-2018-1136 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2018-1136 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-1136 · Nota de Segurança
• https://moodle.org/mod/forum/discuss.php?d=371202 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2018-1136 · Nota de Segurança
• http://securityfocus.com/bid/104307 · Nota
• https://osv.dev/vulnerability/GHSA-xhfw-wjjc-4j5h · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-1136 · Aviso do Fabricante