Description

An issue was discovered in Moodle 3.x. By substituting URLs in portfolios, users can instantiate any class. This can also be exploited by users who are logged in as guests to create a DDoS attack.

Remediation

References

CVE-2018-1137

Related Vulnerabilities

WordPress Plugin Spam protection, AntiSpam, FireWall by CleanTalk SQL Injection (5.153.3)

WordPress Plugin Tabs-Responsive Tabs with WooCommerce Product Tab Extension Cross-Site Scripting (3.7.1)

WordPress Plugin Media Library Assistant PHP Object Injection (2.60)

WordPress Plugin Wp-Pro-Quiz Cross-Site Request Forgery (0.37)

Jenkins 7PK - Security Features Vulnerability (CVE-2014-9634)

Severity

High

Classification

CVE-2018-1137 CWE-20 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Tags

Missing Update Known Vulnerabilities