Moodle XML import of ddwtos could lead to intentional remote code execution
moodle before versions 3.5.2, 3.4.5, 3.3.8, 3.1.14 is vulnerable to an XML import of ddwtos could lead to intentional remote code execution. When importing legacy 'drag and drop into text' (ddwtos) type quiz questions, it was possible to inject and execute PHP code from within the imported questions, either intentionally or by importing questions from an untrusted source.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2018-14630US | high8.8 | — | ||
moodle before versions 3.5.2, 3.4.5, 3.3.8, 3.1.14 is vulnerable to an XML import of ddwtos could lead to intentional remote code execution. When importing legacy 'drag and drop in… | ||||
02
references
External citations — patches, advisories, analysis.
- http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-62880WEB
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14630WEB
- https://github.com/moodle/moodlePACKAGE
- https://github.com/moodle/moodle/commit/09cbca8566a388e8f0a1a0cfd86cd0667088ed2cWEB
- https://github.com/moodle/moodle/commit/be092b730910ad97fff0511e177a097ec1cc4b1cWEB
- https://github.com/moodle/moodle/commit/cb8aefa658cf7ad8f002a480343afb2dea94cc08WEB
- https://github.com/moodle/moodle/commit/cfc4393aa689c277a27b9a040ff7dcbdac4e41ddWEB
- https://github.com/moodle/moodle/commit/da1eeea0ff3d292b7669e478abc114872dd9cc8fWEB
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan