CVE-2018-14630CWE-20

moodle before versions 3.5.2, 3.4.5, 3.3.8, 3.1.14 is vulnerable to an XML import of ddwtos could lead to intentional remote code execution

High · published September 17, 2018

CVSS v3.0
8.8
EPSS
5%
Percentile
91.6
In the wild
Unconfirmed
What it is

moodle before versions 3.5.2, 3.4.5, 3.3.8, 3.1.14 is vulnerable to an XML import of ddwtos could lead to intentional remote code execution. When importing legacy 'drag and drop into text' (ddwtos) type quiz questions, it was possible to inject and execute PHP code from within the imported questions, either intentionally or by importing questions from an untrusted source.

The record
Technical detail
CVSS v3.0
8.8 · HIGH
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.04604 · 91.6th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2018-09-17T18:00Z
EPSS history
Timeline
  • 17 SEP 18:00Z
    moodle before versions 3.5.2, 3.4.5, 3.3.8, 3.1.14 is vulnerable to an XML import of ddwtos could lead to intentional remote code execution
    cvelistv5