SB2018012332 - Fedora 27 update for moodle
Published: January 23, 2018 Updated: April 24, 2025
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 4 secuirty vulnerabilities.
1) Server-Side Request Forgery (SSRF) (CVE-ID: CVE-2018-1042)
The vulnerability allows a remote authenticated user to gain access to sensitive information.
Moodle 3.x has Server Side Request Forgery in the filepicker.
2) Input validation error (CVE-ID: CVE-2018-1043)
The vulnerability allows a remote authenticated user to manipulate data.
In Moodle 3.x, the setting for blocked hosts list can be bypassed with multiple A record hostnames.
3) Information disclosure (CVE-ID: CVE-2018-1044)
The vulnerability allows a remote authenticated user to gain access to sensitive information.
In Moodle 3.x, quiz web services allow students to see quiz results when it is prohibited in the settings.
4) Cross-site scripting (CVE-ID: CVE-2018-1045)
The vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of user-supplied data when processing data passed via a calendar event name. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
Remediation
Install update from vendor's website.