PT-2018-10518 · Moodle · Moodle

Brendan Cox · Published 2018-05-25 · Updated 2022-05-13 · CVE-2018-1136

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Moodle versions 3.x

Description An issue allows authenticated users to add HTML blocks containing scripts to their Dashboard. Normally, this would not be a security issue since a personal dashboard is only visible to the user. However, through this issue, users can move such blocks to other pages where they can be viewed by other users.

Recommendations For Moodle versions 3.x, restrict the ability of users to move HTML blocks to other pages to minimize the risk of exploitation. Consider disabling the addition of HTML blocks containing scripts to the Dashboard until a fix is available.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2018-1136

GHSA-XHFW-WJJC-4J5H

Affected Products

Moodle

References · 9

• https://ubuntu.com/security/CVE-2018-1136 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-1136 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-1136 · Security Note
• https://moodle.org/mod/forum/discuss.php?d=371202 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2018-1136 · Security Note
• https://osv.dev/vulnerability/GHSA-xhfw-wjjc-4j5h · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-1136 · Vendor Advisory
• https://github.com/moodle/moodle · Note
• http://securityfocus.com/bid/104307 · Note