CVE-2018-1042

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Moodle 3.x has Server Side Request Forgery in the filepicker.

Metrics

CVSS 3.0 6.5/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-918

Affected software

No affected versions have been published.

Timeline

Published
Jan 22, 2018
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2018

CVE-2018-104224.8An issue was discovered in HongCMS 3.0.0. The post news feature has Stored XSS via the content field.CVE-2018-104232.7mc-admin/post.php in MiniCMS 1.10 allows remote attackers to obtain a directory listing of the top-level directory of the web root via a linCVE-2018-104242.7mc-admin/post-edit.php in MiniCMS 1.10 allows full path disclosure via a modified id field.CVE-2018-104257.8An issue was discovered in Shanghai 2345 Security Guard 3.7.0. 2345MPCSafe.exe, 2345SafeTray.exe, and 2345Speedup.exe allow local users to bCVE-2018-104286.1ILIAS before 5.1.26, 5.2.x before 5.2.15, and 5.3.x before 5.3.4, due to inconsistencies in parameter handling, is vulnerable to various insCVE-2018-104299.8Cosmo 1.0.0Beta6 allows attackers to execute arbitrary PHP code via the Database Prefix field on the Database Info screen of install.php.CVE-2018-10436.5In Moodle 3.x, the setting for blocked hosts list can be bypassed with multiple A record hostnames.CVE-2018-104304.8An issue was discovered in DiliCMS (aka DiligentCMS) 2.4.0. There is a Stored XSS Vulnerability in the fourth textbox of "System setting->siCVE-2018-104317.2D-Link DIR-615 2.5.17 devices allow Remote Code Execution via shell metacharacters in the Host field of the System / Traceroute screen.CVE-2018-104327.5Pexip Infinity before 18 allows Remote Denial of Service (TLS handshakes in RTMP).CVE-2018-10444.3In Moodle 3.x, quiz web services allow students to see quiz results when it is prohibited in the settings.CVE-2018-10455.4In Moodle 3.x, there is XSS via a calendar event name.
CVE-2018-1042: Medium severity, CVSS 6.5 | Vulnix