Moodle XML import of ddwtos could lead to intentional remote code execution

🗓️ 13 May 2022 01:34:31Reported by GitHub Advisory DatabaseType

Moodle XML import vulnerabilit

Reporter	Title	Published	Views	Family All 27
FreeBSD	moodle -- multiple vulnerabilities	5 Sep 201800:00	–	freebsd
0day.today	Moodle 3.x PHP Unserialize Remote Code Execution Exploit	19 Sep 201800:00	–	zdt
Circl	CVE-2018-14630	19 Sep 201813:04	–	circl
CNVD	Moodle Remote Code Execution Vulnerability	18 Sep 201800:00	–	cnvd
CVE	CVE-2018-14630	17 Sep 201818:00	–	cve
Cvelist	CVE-2018-14630	17 Sep 201818:00	–	cvelist
EUVD	EUVD-2022-3491	3 Oct 202520:07	–	euvd
Fedora	[SECURITY] Fedora 27 Update: moodle-3.3.8-1.fc27	26 Sep 201820:18	–	fedora
Fedora	[SECURITY] Fedora 29 Update: moodle-3.5.2-1.fc29	26 Sep 201820:23	–	fedora
Fedora	[SECURITY] Fedora 28 Update: moodle-3.4.5-1.fc28	27 Sep 201802:36	–	fedora

Vulners

Node

moodle moodleRange<3.1.14composer

moodle moodleRange3.2.0–3.3.8composer

moodle moodleRange3.4.0–3.4.5composer

moodle moodleRange3.5.0–3.5.2composer

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2018-14630
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
moodle	www.moodle.org/mod/forum/discuss.php
seclists	www.seclists.org/fulldisclosure/2018/Sep/28
sec-consult	www.sec-consult.com/en/blog/advisories/remote-code-execution-php-unserialize-moodle-open-source-learning-platform-cve-2018-14630/
git	www.git.moodle.org/gw
github	www.github.com/moodle/moodle/commit/09cbca8566a388e8f0a1a0cfd86cd0667088ed2c
github	www.github.com/moodle/moodle/commit/be092b730910ad97fff0511e177a097ec1cc4b1c
github	www.github.com/moodle/moodle/commit/cb8aefa658cf7ad8f002a480343afb2dea94cc08
github	www.github.com/moodle/moodle/commit/cfc4393aa689c277a27b9a040ff7dcbdac4e41dd

26 Jan 2024 18:00Current

8.1High risk

Vulners AI Score8.1

CVSS 26.5

CVSS 38.8

EPSS0.04425