SB2018071032 - Multiple vulnerabilities in moodle Moodle

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2018071032

SB2018071032 - Multiple vulnerabilities in moodle Moodle

Published: July 10, 2018 Updated: July 17, 2020

Security Bulletin ID SB2018071032
Severity
Medium
Patch available
YES
Number of vulnerabilities 3
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 3 secuirty vulnerabilities.


1) Inclusion of Sensitive Information in Log Files (CVE-ID: CVE-2018-10889)

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

A flaw was found in moodle before versions 3.5.1, 3.4.4, 3.3.7. No option existed to omit logs from data privacy exports, which may contain details of other users who interacted with the requester.


2) Information disclosure (CVE-ID: CVE-2018-10890)

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

A flaw was found in moodle before versions 3.5.1, 3.4.4, 3.3.7, 3.1.13. It was possible for the core_course_get_categories web service to return hidden categories, which should be omitted when fetching course categories.


3) Improper Neutralization of Special Elements in Output Used by a Downstream Component (CVE-ID: CVE-2018-10891)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

A flaw was found in moodle before versions 3.5.1, 3.4.4, 3.3.7, 3.1.13. When a quiz question bank is imported, it was possible for the question preview that is displayed to execute JavaScript that is written into the question bank.


Remediation

Install update from vendor's website.

References