What is GHSA-vxqh-mx28-7ghw?

GHSA-vxqh-mx28-7ghw is a security advisory published by GitHub Security Advisories with High severity. Moodle Portfolio script allows instantiation of class chosen by user

Which CVE IDs does GHSA-vxqh-mx28-7ghw cover?

GHSA-vxqh-mx28-7ghw covers the following CVE IDs: CVE-2018-1137. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-vxqh-mx28-7ghw?

GHSA-vxqh-mx28-7ghw has a CVSS v3 base score of 8.1, published by GitHub Security Advisories.

Which products are affected by GHSA-vxqh-mx28-7ghw?

GHSA-vxqh-mx28-7ghw affects 4 products, including: composer/moodle/moodle:\u003e= 3.1, \u003c 3.1.12; composer/moodle/moodle:\u003e= 3.2, \u003c 3.2.9; composer/moodle/moodle:\u003e= 3.3, \u003c 3.3.6; composer/moodle/moodle:\u003e= 3.4, \u003c 3.4.3.

GHSA-vxqh-mx28-7ghwHighCVSS 8.1

Moodle Portfolio script allows instantiation of class chosen by user

Vendor

GitHub Security Advisories

Published

May 14, 2022

Last Modified

April 23, 2024

🔗 CVE IDs covered (1)

CVE-2018-1137 →

📋 Description

An issue was discovered in Moodle 3.x. By substituting URLs in portfolios, users can instantiate any class. This can also be exploited by users who are logged in as guests to create a DDoS attack.

🎯 Affected products4

composer/moodle/moodle:>= 3.1, < 3.1.12
composer/moodle/moodle:>= 3.2, < 3.2.9
composer/moodle/moodle:>= 3.3, < 3.3.6
composer/moodle/moodle:>= 3.4, < 3.4.3

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2018-1137
https://moodle.org/mod/forum/discuss.php?d=371204
http://www.securityfocus.com/bid/104307
https://github.com/advisories/GHSA-vxqh-mx28-7ghw