CVE-2018-1137: Input Validation
First published: Fri May 25 2018(Updated: )
An issue was discovered in Moodle 3.x. By substituting URLs in portfolios, users can instantiate any class. This can also be exploited by users who are logged in as guests to create a DDoS attack.
Credit: secalert@redhat.com secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| composer/moodle/moodle | >=3.4<3.4.3 | 3.4.3 |
| composer/moodle/moodle | >=3.3<3.3.6 | 3.3.6 |
| composer/moodle/moodle | >=3.2<3.2.9 | 3.2.9 |
| composer/moodle/moodle | >=3.1<3.1.12 | 3.1.12 |
| Moodle | >=3.1.0<=3.1.11 | |
| Moodle | >=3.2.0<=3.2.8 | |
| Moodle | >=3.3.0<=3.3.5 | |
| Moodle | >=3.4.0<=3.4.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2018-1137?
CVE-2018-1137 is classified as a medium severity vulnerability.
How do I fix CVE-2018-1137?
To fix CVE-2018-1137, upgrade Moodle to versions 3.1.12, 3.2.9, 3.3.6, or 3.4.3.
What versions of Moodle are affected by CVE-2018-1137?
Moodle versions 3.1.0 to 3.1.11, 3.2.0 to 3.2.8, 3.3.0 to 3.3.5, and 3.4.0 to 3.4.2 are affected by CVE-2018-1137.
Can guest users exploit CVE-2018-1137?
Yes, logged-in guest users can exploit CVE-2018-1137 to create a DDoS attack.
What type of attack can result from CVE-2018-1137?
CVE-2018-1137 can result in a DDoS attack due to the exploitation of class instantiation through substituted URLs.
- agent/type
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-vxqh-mx28-7ghw
- alias/CVE-2018-1137
- agent/software-canonical-lookup
- agent/severity
- agent/weakness
- agent/references
- agent/description
- agent/author
- collector/github-advisory
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/event
- agent/first-publish-date
- agent/trending
- agent/source
- collector/nvd-cve
- source/NVD
- agent/software-canonical-lookup-request
- collector/nvd-index
- agent/softwarecombine
- agent/tags
- package-manager/composer
- vendor/moodle
- canonical/moodle
- version/moodle/3.1.0
- version/moodle/3.1.11
- version/moodle/3.2.0
- version/moodle/3.2.8
- version/moodle/3.3.0
- version/moodle/3.3.5
- version/moodle/3.4.0
- version/moodle/3.4.2