Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2018-14630

Good to know:

icon

Date: September 17, 2018

moodle before versions 3.5.2, 3.4.5, 3.3.8, 3.1.14 is vulnerable to an XML import of ddwtos could lead to intentional remote code execution. When importing legacy 'drag and drop into text' (ddwtos) type quiz questions, it was possible to inject and execute PHP code from within the imported questions, either intentionally or by importing questions from an untrusted source.

Language: PHP

Severity Score

Related Resources (16)

http://www.securityfocus.com/bid/105354
https://nvd.nist.gov/vuln/detail/CVE-2018-14630
https://web.archive.org/web/20200227111301/https://www.securityfocus.com/bid/105354
https://github.com/moodle/moodle/commit/cfc4393aa689c277a27b9a040ff7dcbdac4e41dd
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14630
https://github.com/moodle/moodle/commit/cb8aefa658cf7ad8f002a480343afb2dea94cc08
https://github.com/moodle/moodle/commit/09cbca8566a388e8f0a1a0cfd86cd0667088ed2c
http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-62880
https://www.sec-consult.com/en/blog/advisories/remote-code-execution-php-unserialize-moodle-open-source-learning-platform-cve-2018-14630
https://www.sec-consult.com/en/blog/advisories/remote-code-execution-php-unserialize-moodle-open-source-learning-platform-cve-2018-14630/
https://seclists.org/fulldisclosure/2018/Sep/28
https://github.com/moodle/moodle/commit/be092b730910ad97fff0511e177a097ec1cc4b1c
https://moodle.org/mod/forum/discuss.php?d=376023
https://github.com/moodle/moodle
https://github.com/moodle/moodle/commit/da1eeea0ff3d292b7669e478abc114872dd9cc8f
https://www.mend.io/vulnerability-database/CVE-2018-14630

Severity Score

Weakness Type (CWE)

Improper Control of Generation of Code ('Code Injection')

CWE-94

Improper Input Validation

CWE-20

Top Fix

icon

Upgrade Version

Upgrade to version moodle/moodle - v3.1.14;moodle/moodle - dev-MOODLE_31_STABLE;moodle/moodle - dev-MOODLE_33_STABLE;moodle/moodle - v3.3.8;moodle/moodle - v3.4.5;moodle/moodle - v3.5.2

Learn More

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): LOW
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): HIGH
Integrity (I): HIGH
Availability (A): HIGH

CVSS v2

Base Score:
Access Vector (AV): NETWORK
Access Complexity (AC): LOW
Authentication (AU): SINGLE
Confidentiality (C): PARTIAL
Integrity (I): PARTIAL
Availability (A): PARTIAL
Additional information:

Do you need more information?

Contact Us