CVE-2018-1137: Moodle Portfolio script allows instantiation of class chosen by user
Summary
CVE-2018-1137: Moodle Portfolio script allows instantiation of class chosen by user. Affects moodle/moodle across 4 version ranges.
>= 3.1, < 3.1.12
>= 3.2, < 3.2.9
>= 3.3, < 3.3.6
>= 3.4, < 3.4.3
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning management system used by educational institutions worldwide. It provides a platform for creating and managing online courses, allowing educators to deliver content and interact with students. The Moodle package, specifically versions 3.1 to 3.4, is affected by a vulnerability that allows users to instantiate any class by substituting URLs in portfolios. This vulnerability can be exploited by both authenticated users and guests, potentially leading to a distributed denial-of-service (DDoS) attack.
Vulnerability Detail
The vulnerability in Moodle allows users to manipulate URLs in portfolios, enabling the instantiation of any class. This means that an attacker can execute arbitrary code and potentially disrupt the system. The impact of this vulnerability is significant, as it can be leveraged by both authenticated users and guests to cause a DDoS attack. The vulnerability has a CVSS score of 8.1, indicating a high severity level.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 3.1, < 3.1.123.1.12composer require moodle/moodle:3.1.12 -
>= 3.2, < 3.2.93.2.9composer require moodle/moodle:3.2.9 -
>= 3.3, < 3.3.63.3.6composer require moodle/moodle:3.3.6 -
>= 3.4, < 3.4.33.4.3composer require moodle/moodle:3.4.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended approach is to apply the available patches or upgrade to the fixed versions of Moodle.
Conclusion
The vulnerability in Moodle allows users to instantiate any class, posing a significant risk to the system's security. It is crucial to apply the available patches or upgrade to the fixed versions to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for moodle/moodle →
FAQ
Moodle is an open-source learning management system used by educational institutions to create and manage online courses.
The vulnerability allows users to instantiate any class, potentially leading to a DDoS attack and disruption of the Moodle system.
Both authenticated users and guests can exploit this vulnerability.
To fix this vulnerability, upgrade to the patched versions of Moodle (3.1.12, 3.2.9, 3.3.6, or 3.4.3).
There is no specific workaround mentioned. Applying the patches or upgrading to fixed versions is recommended.
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
