CVE-2018-1136
25.05.2018, 12:29
An issue was discovered in Moodle 3.x. An authenticated user is allowed to add HTML blocks containing scripts to their Dashboard; this is normally not a security issue because a personal dashboard is visible to this user only. Through this security vulnerability, users can move such a block to other pages where they can be viewed by other users.
| Vendor | Product | Version |
|---|---|---|
| moodle | moodle | 3.1.0 ≤ 𝑥 ≤ 3.1.11 |
| moodle | moodle | 3.2.0 ≤ 𝑥 ≤ 3.2.8 |
| moodle | moodle | 3.3.0 ≤ 𝑥 ≤ 3.3.5 |
| moodle | moodle | 3.4.0 ≤ 𝑥 ≤ 3.4.2 |
𝑥
= Vulnerable software versions
Ubuntu Releases