Moodle XML import of ddwtos could lead to intentional remote code execution
moodle before versions 3.5.2, 3.4.5, 3.3.8, 3.1.14 is vulnerable to an XML import of ddwtos could lead to intentional remote code execution. When importing legacy 'drag and drop into text' (ddwtos) type quiz questions, it was possible to inject and execute PHP code from within the imported questions, either intentionally or by importing questions from an untrusted source.
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2018-14630US | high8.8 | — | ||
moodle before versions 3.5.2, 3.4.5, 3.3.8, 3.1.14 is vulnerable to an XML import of ddwtos could lead to intentional remote code execution. When importing legacy 'drag and drop in… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-62880WEB
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14630WEB
- https://github.com/moodle/moodlePACKAGE
- https://github.com/moodle/moodle/commit/09cbca8566a388e8f0a1a0cfd86cd0667088ed2cWEB
- https://github.com/moodle/moodle/commit/be092b730910ad97fff0511e177a097ec1cc4b1cWEB
- https://github.com/moodle/moodle/commit/cb8aefa658cf7ad8f002a480343afb2dea94cc08WEB
- https://github.com/moodle/moodle/commit/cfc4393aa689c277a27b9a040ff7dcbdac4e41ddWEB
- https://github.com/moodle/moodle/commit/da1eeea0ff3d292b7669e478abc114872dd9cc8fWEB
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan