PT-2018-12627 · Moodle · Moodle

Michael Hawkins · Published 2018-09-17 · Updated 2022-05-13 · CVE-2018-14631

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions moodle versions prior to 3.5.2 moodle versions prior to 3.4.5 moodle versions prior to 3.3.8

Description The issue concerns a reflected XSS vulnerability due to insufficient filtering of the search parameter in the breadcrumb navigation provided by the Boost theme when displaying search results of a blog. This could result in reflected XSS if a user followed a malicious link containing JavaScript in the search parameter.

Recommendations For versions prior to 3.5.2, update to version 3.5.2 or later. For versions prior to 3.4.5, update to version 3.4.5 or later. For versions prior to 3.3.8, update to version 3.3.8 or later.

Fix

RCE

XSS

Weakness Enumeration

CWE-20

CWE-79

Related Identifiers

CVE-2018-14631

GHSA-GQRP-QHV8-PHRV

Affected Products

Moodle

References · 11

• http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-62857 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-14631 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-14631 · Security Note
• https://osv.dev/vulnerability/GHSA-gqrp-qhv8-phrv · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-14631 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2018-14631 · Security Note
• https://moodle.org/mod/forum/discuss.php?d=376025 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-14631 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14631 · Patch
• https://github.com/moodle/moodle · Note
• http://securityfocus.com/bid/105371 · Note