PT-2018-10508 · Moodle · Moodle

Brendan Cox · Published 2018-05-25 · Updated 2022-05-14 · CVE-2018-1135

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Moodle versions 3.x

Description An issue allows students who have posted on forums and exported these posts to portfolios to download any stored Moodle file. This is achieved by modifying the download URL.

Recommendations For Moodle versions 3.x, consider restricting access to the portfolio export feature for students until a fix is available. As a temporary workaround, monitor and limit changes to download URLs to prevent unauthorized file access.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2018-1135

GHSA-VXMV-74RF-VQGP

Affected Products

Moodle

References · 9

• https://moodle.org/mod/forum/discuss.php?d=371201 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-vxmv-74rf-vqgp · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-1135 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-1135 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-1135 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2018-1135 · Security Note
• https://osv.dev/vulnerability/CVE-2018-1135 · Vendor Advisory
• https://github.com/moodle/moodle · Note
• http://securityfocus.com/bid/104307 · Note