Multiple vulnerabilities in moodle Moodle
| Risk | Medium |
| Patch available | YES |
| Number of vulnerabilities | 3 |
| CVE-ID | CVE-2018-10889 CVE-2018-10890 CVE-2018-10891 |
| CWE-ID | CWE-532 CWE-200 CWE-74 |
| Exploitation vector | Network |
| Public exploit | N/A |
| Vulnerable software Subscribe |
Moodle Web applications / Other software |
| Vendor | moodle.org |
Security Bulletin
This security bulletin contains information about 3 vulnerabilities.
1) Inclusion of Sensitive Information in Log Files
EUVDB-ID: #VU31272
Risk: Medium
CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2018-10889
CWE-ID:
CWE-532 - Information Exposure Through Log Files
Exploit availability: No
DescriptionThe vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.
A flaw was found in moodle before versions 3.5.1, 3.4.4, 3.3.7. No option existed to omit logs from data privacy exports, which may contain details of other users who interacted with the requester.
MitigationInstall update from vendor's website.
Vulnerable software versionsMoodle: 3.5.0 - 3.5.0 rc1
External linkshttp://www.securityfocus.com/bid/104733
http://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10889
http://moodle.org/mod/forum/discuss.php?d=373369
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
2) Information disclosure
EUVDB-ID: #VU31273
Risk: Medium
CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2018-10890
CWE-ID:
CWE-200 - Information exposure
Exploit availability: No
DescriptionThe vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.
A flaw was found in moodle before versions 3.5.1, 3.4.4, 3.3.7, 3.1.13. It was possible for the core_course_get_categories web service to return hidden categories, which should be omitted when fetching course categories.
MitigationInstall update from vendor's website.
Vulnerable software versionsMoodle: 3.5.0 - 3.5.0 rc1
External linkshttp://www.securityfocus.com/bid/104738
http://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10890
http://moodle.org/mod/forum/discuss.php?d=373370
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
3) Improper Neutralization of Special Elements in Output Used by a Downstream Component
EUVDB-ID: #VU31274
Risk: Medium
CVSSv3.1: 6.4 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:U/RL:O/RC:C]
CVE-ID: CVE-2018-10891
Exploit availability: No
DescriptionThe vulnerability allows a remote non-authenticated attacker to read and manipulate data.
A flaw was found in moodle before versions 3.5.1, 3.4.4, 3.3.7, 3.1.13. When a quiz question bank is imported, it was possible for the question preview that is displayed to execute JavaScript that is written into the question bank.
MitigationInstall update from vendor's website.
Vulnerable software versionsMoodle: 3.5.0 - 3.5.0 rc1
External linkshttp://www.securityfocus.com/bid/104739
http://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10891
http://moodle.org/mod/forum/discuss.php?d=373371
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
