PT-2018-12626 · Moodle · Moodle

Johannes Moritz · Published 2018-09-17 · Updated 2022-05-13 · CVE-2018-14630

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions moodle versions prior to 3.5.2 moodle versions prior to 3.4.5 moodle versions prior to 3.3.8 moodle versions prior to 3.1.14

Description The issue allows for intentional remote code execution when importing legacy 'drag and drop into text' (ddwtos) type quiz questions. This could lead to the injection and execution of PHP code from within the imported questions, either intentionally or by importing questions from an untrusted source.

Recommendations For versions prior to 3.5.2, update to version 3.5.2 or later. For versions prior to 3.4.5, update to version 3.4.5 or later. For versions prior to 3.3.8, update to version 3.3.8 or later. For versions prior to 3.1.14, update to version 3.1.14 or later.

Exploit

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

CWE-20

Related Identifiers

CVE-2018-14630

GHSA-C3PR-H96W-2JJG

Affected Products

Moodle

References · 20

• 🔥 https://seclists.org/fulldisclosure/2018/Sep/28 · Exploit
• 🔥 https://sec-consult.com/en/blog/advisories/remote-code-execution-php-unserialize-moodle-open-source-learning-platform-cve-2018-14630 · Exploit
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14630 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2018-14630 · Security Note
• http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-62880 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2018-14630 · Security Note
• https://moodle.org/mod/forum/discuss.php?d=376023 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-14630 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-c3pr-h96w-2jjg · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-14630 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-14630 · Vendor Advisory
• https://github.com/moodle/moodle · Note
• https://github.com/moodle/moodle/commit/be092b730910ad97fff0511e177a097ec1cc4b1c · Note
• https://github.com/moodle/moodle/commit/09cbca8566a388e8f0a1a0cfd86cd0667088ed2c · Note
• https://github.com/moodle/moodle/commit/cb8aefa658cf7ad8f002a480343afb2dea94cc08 · Note