SB2018073054 - Fedora 28 update for moodle

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2018073054

SB2018073054 - Fedora 28 update for moodle

Published: July 30, 2018 Updated: April 24, 2025

Security Bulletin ID SB2018073054
Severity
Medium
Patch available
YES
Number of vulnerabilities 3
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 3 secuirty vulnerabilities.


1) Inclusion of Sensitive Information in Log Files (CVE-ID: CVE-2018-10889)

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

A flaw was found in moodle before versions 3.5.1, 3.4.4, 3.3.7. No option existed to omit logs from data privacy exports, which may contain details of other users who interacted with the requester.


2) Information disclosure (CVE-ID: CVE-2018-10890)

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

A flaw was found in moodle before versions 3.5.1, 3.4.4, 3.3.7, 3.1.13. It was possible for the core_course_get_categories web service to return hidden categories, which should be omitted when fetching course categories.


3) Improper Neutralization of Special Elements in Output Used by a Downstream Component (CVE-ID: CVE-2018-10891)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

A flaw was found in moodle before versions 3.5.1, 3.4.4, 3.3.7, 3.1.13. When a quiz question bank is imported, it was possible for the question preview that is displayed to execute JavaScript that is written into the question bank.


Remediation

Install update from vendor's website.

References