PT-2018-12627 · Moodle · Moodle

Michael Hawkins · Publicado 2018-09-17 · Atualizado 2022-05-13 · CVE-2018-14631

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions moodle versions prior to 3.5.2 moodle versions prior to 3.4.5 moodle versions prior to 3.3.8

Description The issue concerns a reflected XSS vulnerability due to insufficient filtering of the search parameter in the breadcrumb navigation provided by the Boost theme when displaying search results of a blog. This could result in reflected XSS if a user followed a malicious link containing JavaScript in the search parameter.

Recommendations For versions prior to 3.5.2, update to version 3.5.2 or later. For versions prior to 3.4.5, update to version 3.4.5 or later. For versions prior to 3.3.8, update to version 3.3.8 or later.

Correção

RCE

XSS

Enumeração de Fraquezas

CWE-20

CWE-79

Identificadores relacionados

CVE-2018-14631

GHSA-GQRP-QHV8-PHRV

Produtos afetados

Moodle

Referências · 11

• https://github.com/moodle/moodle · Nota
• http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-62857 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2018-14631 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-14631 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-gqrp-qhv8-phrv · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2018-14631 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2018-14631 · Nota de Segurança
• https://moodle.org/mod/forum/discuss.php?d=376025 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-14631 · Aviso do Fabricante
• http://securityfocus.com/bid/105371 · Nota
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14631 · Correção