CVE-2020-10738: Input Validation
First published: Thu May 21 2020(Updated: )
A flaw was found in Moodle versions 3.8 before 3.8.3, 3.7 before 3.7.6, 3.6 before 3.6.10, 3.5 before 3.5.12 and earlier unsupported versions. It was possible to create a SCORM package in such a way that when added to a course, it could be interacted with via web services in order to achieve remote code execution.
Credit: secalert@redhat.com secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| composer/moodle/moodle | >=3.5<=3.5.11 | 3.5.12 |
| composer/moodle/moodle | >=3.6<=3.6.9 | 3.6.10 |
| composer/moodle/moodle | >=3.7<=3.7.5 | 3.7.6 |
| composer/moodle/moodle | >=3.8<=3.8.2 | 3.8.3 |
| Moodle Moodle | >=3.5<3.5.12 | |
| Moodle Moodle | >=3.6<3.6.10 | |
| Moodle Moodle | >=3.7<3.7.6 | |
| Moodle Moodle | >=3.8<3.8.3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://nvd.nist.gov/vuln/detail/CVE-2020-10738
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10738
- https://moodle.org/mod/forum/discuss.php?d=403513
- http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-68410
- https://github.com/moodle/moodle/commit/2cd534a7df3867813e3aad42db615865149a58c6
- https://github.com/advisories/GHSA-vr6v-g96p-cjc3 (Advisory)
Frequently Asked Questions
What is CVE-2020-10738?
CVE-2020-10738 is a vulnerability found in Moodle versions 3.8 before 3.8.3, 3.7 before 3.7.6, 3.6 before 3.6.10, 3.5 before 3.5.12, and earlier unsupported versions.
How can this vulnerability be exploited?
This vulnerability allows an attacker to interact with a SCORM package added to a course via web services, enabling remote attacks.
What is the severity of CVE-2020-10738?
The severity of CVE-2020-10738 is rated as high, with a severity score of 8.8.
Which versions of Moodle are affected?
Moodle versions 3.8 before 3.8.3, 3.7 before 3.7.6, 3.6 before 3.6.10, 3.5 before 3.5.12, and earlier unsupported versions are affected.
How can I fix CVE-2020-10738?
To fix CVE-2020-10738, upgrade to Moodle versions 3.8.3, 3.7.6, 3.6.10, or 3.5.12, depending on the affected version.
- collector/github-advisory-latest
- alias/GHSA-vr6v-g96p-cjc3
- alias/CVE-2020-10738
- collector/github-advisory
- collector/nvd-index
- collector/nvd-cve
- package-manager/composer
- vendor/moodle
- canonical/moodle moodle
- version/moodle moodle/3.5
- version/moodle moodle/3.6
- version/moodle moodle/3.7
- version/moodle moodle/3.8