PT-2018-12626 · Moodle · Moodle

Johannes Moritz · Publicado 2018-09-17 · Atualizado 2022-05-13 · CVE-2018-14630

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions moodle versions prior to 3.5.2 moodle versions prior to 3.4.5 moodle versions prior to 3.3.8 moodle versions prior to 3.1.14

Description The issue allows for intentional remote code execution when importing legacy 'drag and drop into text' (ddwtos) type quiz questions. This could lead to the injection and execution of PHP code from within the imported questions, either intentionally or by importing questions from an untrusted source.

Recommendations For versions prior to 3.5.2, update to version 3.5.2 or later. For versions prior to 3.4.5, update to version 3.4.5 or later. For versions prior to 3.3.8, update to version 3.3.8 or later. For versions prior to 3.1.14, update to version 3.1.14 or later.

Exploit

Correção

RCE

Code Injection

Enumeração de Fraquezas

CWE-94

CWE-20

Identificadores relacionados

CVE-2018-14630

GHSA-C3PR-H96W-2JJG

Produtos afetados

Moodle

Referências · 20

• 🔥 https://seclists.org/fulldisclosure/2018/Sep/28 · Exploit
• 🔥 https://sec-consult.com/en/blog/advisories/remote-code-execution-php-unserialize-moodle-open-source-learning-platform-cve-2018-14630 · Exploit
• https://github.com/moodle/moodle · Nota
• https://github.com/moodle/moodle/commit/be092b730910ad97fff0511e177a097ec1cc4b1c · Nota
• https://github.com/moodle/moodle/commit/09cbca8566a388e8f0a1a0cfd86cd0667088ed2c · Nota
• https://github.com/moodle/moodle/commit/cb8aefa658cf7ad8f002a480343afb2dea94cc08 · Nota
• https://github.com/moodle/moodle/commit/cfc4393aa689c277a27b9a040ff7dcbdac4e41dd · Nota
• https://github.com/moodle/moodle/commit/da1eeea0ff3d292b7669e478abc114872dd9cc8f · Nota
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14630 · Correção
• https://web.archive.org/web/20200227111301/https://securityfocus.com/bid/105354 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-14630 · Nota de Segurança
• http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-62880 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2018-14630 · Nota de Segurança
• https://moodle.org/mod/forum/discuss.php?d=376023 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2018-14630 · Aviso do Fabricante