PT-2018-10497 · Moodle · Moodle

Brendan Cox · Published 2018-05-25 · Updated 2022-05-13 · CVE-2018-1134

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Moodle versions 3.x

Description An issue allows students who submitted assignments and exported them to portfolios to download any stored Moodle file by changing the download URL.

Recommendations For Moodle versions 3.x, update to a version where this issue is fixed, or as a temporary workaround, consider restricting access to the portfolio export feature to prevent unauthorized file downloads.

Fix

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2018-1134

GHSA-XJX9-7C29-PWMM

Affected Products

Moodle

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2018-1134 · Security Note
• https://osv.dev/vulnerability/GHSA-xjx9-7c29-pwmm · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-1134 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-1134 · Vendor Advisory
• https://moodle.org/mod/forum/discuss.php?d=371200 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-1134 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2018-1134 · Security Note
• https://github.com/moodle/moodle · Note
• http://securityfocus.com/bid/104307 · Note