PT-2018-13773 · Moodle · Moodle

Daniel Thatcher · Publicado 2018-11-26 · Atualizado 2022-05-13 · CVE-2018-16854

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions moodle versions 3.1 to 3.1.14 moodle versions 3.3 to 3.3.8 moodle versions 3.4 to 3.4.5 moodle versions 3.5 to 3.5.2

Description A flaw was found in the login form, which is not protected by a token to prevent login cross-site request forgery.

Recommendations For moodle versions 3.1 to 3.1.14, update to version 3.1.15. For moodle versions 3.3 to 3.3.8, update to version 3.3.9. For moodle versions 3.4 to 3.4.5, update to version 3.4.6. For moodle versions 3.5 to 3.5.2, update to version 3.5.3.

Exploit

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2018-16854

GHSA-XJ5F-QV37-R9JC

Produtos afetados

Moodle

Referências · 13

• 🔥 https://github.com/danielthatcher/moodle-login-csrf · Exploit
• https://github.com/moodle/moodle · Nota
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16854 · Correção
• https://moodle.org/mod/forum/discuss.php?d=378731 · Aviso do Fabricante
• http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-63183 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-16854 · Nota de Segurança
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-16854 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-xj5f-qv37-r9jc · Aviso do Fabricante
• http://securitytracker.com/id/1042154 · Nota
• https://osv.dev/vulnerability/CVE-2018-16854 · Aviso do Fabricante
• http://securityfocus.com/bid/106017 · Nota
• https://cve.org/CVERecord?id=CVE-2018-16854 · Nota de Segurança
• https://ubuntu.com/security/CVE-2018-16854 · Aviso do Fabricante