GHSA-vxqh-mx28-7ghw

ghsaUSosv

Moodle Portfolio script allows instantiation of class chosen by user

view advisory published 2022-05-14Licence: CC-BY-4.0

An issue was discovered in Moodle 3.x. By substituting URLs in portfolios, users can instantiate any class. This can also be exploited by users who are logged in as guests to create a DDoS attack.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2018-1137US	high8.1	1.74% (78th)	—	2018-05-25
An issue was discovered in Moodle 3.x. By substituting URLs in portfolios, users can instantiate any class. This can also be exploited by users who are logged in as guests to creat…

references

External citations — patches, advisories, analysis.

http://www.securityfocus.com/bid/104307WEB
https://github.com/moodle/moodlePACKAGE
https://moodle.org/mod/forum/discuss.php?d=371204WEB
https://nvd.nist.gov/vuln/detail/CVE-2018-1137ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan