Description
moodle before versions 3.5.2, 3.4.5, 3.3.8, 3.1.14 is vulnerable to an XML import of ddwtos could lead to intentional remote code execution. When importing legacy 'drag and drop into text' (ddwtos) type quiz questions, it was possible to inject and execute PHP code from within the imported questions, either intentionally or by importing questions from an untrusted source.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| [UNKNOWN] | moodle | 3.5.2, 3.4.5, 3.3.8, 3.1.14 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 18.04 LTS | moodle | No fix yet | — |
| Ubuntu Pro 16.04 LTS | moodle | No fix yet | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | moodle/moodle | >= 3.5.0, < 3.5.2 | 3.5.2 | GHSA-c3pr-h96w-2jjg |
| Packagist | moodle/moodle | >= 3.4.0, < 3.4.5 | 3.4.5 | GHSA-c3pr-h96w-2jjg |
| Packagist | moodle/moodle | >= 3.2.0, < 3.3.8 | 3.3.8 | GHSA-c3pr-h96w-2jjg |
| Packagist | moodle/moodle | < 3.1.14 | 3.1.14 | GHSA-c3pr-h96w-2jjg |
References
- 105354 vdb-entry
- http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-62880
- https://moodle.org/mod/forum/discuss.php?d=376023
- 20180918 SEC Consult SA-20180918-0 :: Remote Code Execution via PHP unserialize in Moodle open-source learning platform mailing-list
- https://www.sec-consult.com/en/blog/advisories/remote-code-execution-php-unserialize-moodle-open-source-learning-platform-cve-2018-14630/
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14630