CVE-2013-3630: Moodle Authenticated Spelling Binary Remote Code Execution
Moodle Authenticated Spelling Binary Remote Code Execution
Other sources
Moodle through 2.5.2 allows remote authenticated administrators to execute arbitrary programs by configuring the aspell pathname and then triggering a spell-check operation within the TinyMCE editor.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 2.5.3
Event History
Frequently Asked Questions
What is the severity of CVE-2013-3630?
CVE-2013-3630 has a high severity rating due to its ability to allow remote authenticated administrators to execute arbitrary commands.
How do I fix CVE-2013-3630?
To fix CVE-2013-3630, upgrade to Moodle version 2.5.3 or later.
Who is affected by CVE-2013-3630?
CVE-2013-3630 affects all versions of Moodle up to and including 2.5.2.
What type of vulnerability is CVE-2013-3630?
CVE-2013-3630 is classified as a command injection vulnerability.
Can I exploit CVE-2013-3630 remotely?
Yes, CVE-2013-3630 can be exploited remotely by authenticated administrators.