GHSA-vxmv-74rf-vqgp

ghsaUSosv

Moodle Portfolio forum caller class allows a user to download any file

view advisory published 2022-05-14Licence: CC-BY-4.0

An issue was discovered in Moodle 3.x. Students who posted on forums and exported the posts to portfolios can download any stored Moodle file by changing the download URL.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2018-1135US	medium6.5	1.29% (70th)	—	2018-05-25
An issue was discovered in Moodle 3.x. Students who posted on forums and exported the posts to portfolios can download any stored Moodle file by changing the download URL.

references

External citations — patches, advisories, analysis.

http://www.securityfocus.com/bid/104307WEB
https://github.com/moodle/moodlePACKAGE
https://moodle.org/mod/forum/discuss.php?d=371201WEB
https://nvd.nist.gov/vuln/detail/CVE-2018-1135ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan