CVE-2018-14630

Packagist/moodle/moodle CVE-2018-14630: high 8.8

Moodle XML import of ddwtos could lead to intentional remote code execution

Action: Upgrade moodle/moodle to 3.1.14 or later.

composer require moodle/moodle:3.5.2

composer require moodle/moodle:3.4.5

composer require moodle/moodle:3.3.8

composer require moodle/moodle:3.1.14

Affected

Fixed versions

Sources

• osv: GHSA-c3pr-h96w-2jjg
• https://nvd.nist.gov/vuln/detail/CVE-2018-14630
• https://github.com/moodle/moodle/commit/09cbca8566a388e8f0a1a0cfd86cd0667088ed2c
• https://github.com/moodle/moodle/commit/be092b730910ad97fff0511e177a097ec1cc4b1c
• https://github.com/moodle/moodle/commit/cb8aefa658cf7ad8f002a480343afb2dea94cc08
• https://github.com/moodle/moodle/commit/cfc4393aa689c277a27b9a040ff7dcbdac4e41dd
• https://github.com/moodle/moodle/commit/da1eeea0ff3d292b7669e478abc114872dd9cc8f
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14630
• https://github.com/moodle/moodle
• https://moodle.org/mod/forum/discuss.php?d=376023
• https://seclists.org/fulldisclosure/2018/Sep/28
• https://web.archive.org/web/20200227111301/https://www.securityfocus.com/bid/105354
• https://www.sec-consult.com/en/blog/advisories/remote-code-execution-php-unserialize-moodle-open-source-learning-platform-cve-2018-14630
• http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-62880

CVE-2018-14630 · published 2022-05-13T01:34:31Z · modified 2024-02-16T08:23:02.924477Z · JSON