CVE-2018-1133: Moodle Calculated Question Type Remote Code Execution
Summary
CVE-2018-1133: Moodle calculated question type allows remote code execution by Question authors. Affects moodle/moodle across 4 version ranges.
>= 3.1, < 3.1.12
>= 3.2, < 3.2.9
>= 3.3, < 3.3.6
>= 3.4, < 3.4.3
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning management system widely used for online education. It provides a platform for educators to create and deliver courses, manage student enrollment, and facilitate communication and collaboration. The Calculated question type in Moodle allows teachers to create questions with dynamically calculated answers based on formulas and variables. This feature enhances the flexibility and interactivity of assessments. However, a vulnerability in Moodle's Calculated question type exposes the system to remote code execution by question authors.
Vulnerability Detail
The vulnerability, identified as CVE-2018-1133, allows a teacher with the ability to create Calculated questions to inject malicious code that will be executed on the server. By crafting a specially designed Calculated question, an attacker can exploit an eval injection vulnerability, leading to arbitrary code execution. This can have severe consequences, including unauthorized access to sensitive data, modification of course content, and potential compromise of the entire Moodle instance. The vulnerability has a CVSS score of 8.8, indicating a high severity level.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 3.1, < 3.1.123.1.12composer require moodle/moodle:3.1.12 -
>= 3.2, < 3.2.93.2.9composer require moodle/moodle:3.2.9 -
>= 3.3, < 3.3.63.3.6composer require moodle/moodle:3.3.6 -
>= 3.4, < 3.4.33.4.3composer require moodle/moodle:3.4.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, administrators can disable the Calculated question type in Moodle until the system is updated to a secure version. This can be achieved by modifying the question type settings or by restricting the permissions of teachers who have access to the Calculated question type. However, disabling the feature may impact the functionality and interactivity of existing assessments, so it should be considered a temporary measure until the upgrade can be performed.
Conclusion
The CVE-2018-1133 vulnerability in Moodle's Calculated question type exposes the system to remote code execution by question authors. It is crucial for administrators to promptly update their Moodle installations to versions 3.1.12, 3.2.9, 3.3.6, or 3.4.3, or any subsequent releases that include the fix. Disabling the Calculated question type can serve as a temporary workaround. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for moodle/moodle →
FAQ
Moodle is an open-source learning management system used for online education. It provides a platform for educators to create and deliver courses, manage student enrollment, and facilitate communication and collaboration.
The Calculated question type in Moodle allows teachers to create questions with dynamically calculated answers based on formulas and variables. It enhances the flexibility and interactivity of assessments.
Remote code execution refers to the ability of an attacker to execute arbitrary code on a target system from a remote location. In the case of this vulnerability, a teacher with the ability to create Calculated questions can inject malicious code that will be executed on the Moodle server.
The consequences of this vulnerability can be severe. An attacker exploiting this vulnerability can gain unauthorized access to sensitive data, modify course content, and potentially compromise the entire Moodle instance.
To protect your Moodle instance, it is crucial to update to a version that includes the necessary security patches. Follow the official Moodle documentation for the upgrade process. As a temporary workaround, you can disable the Calculated question type until the upgrade is performed.
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
