CVE-2018-1137

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

An issue was discovered in Moodle 3.x. By substituting URLs in portfolios, users can instantiate any class. This can also be exploited by users who are logged in as guests to create a DDoS attack.

Metrics

CVSS 3.0 8.1/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-20

Affected software

VendorProductVersions
n/aMoodle 3.x unknownMoodle 3.x unknown

References

Timeline

Published
May 25, 2018
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2018

CVE-2018-113718.8SkyCaiji 1.2 allows CSRF to add an Administrator user.CVE-2018-113729.8iScripts eSwap v2.4 has SQL injection via the wishlistdetailed.php User Panel ToId parameter.CVE-2018-113739.8iScripts eSwap v2.4 has SQL injection via the "salelistdetailed.php" User Panel ToId parameter.CVE-2018-113755.5The _inst__lds() function in radare2 2.5.0 allows remote attackers to cause a denial of service (heap-based out-of-bounds read and applicatiCVE-2018-113765.5The r_read_le32() function in radare2 2.5.0 allows remote attackers to cause a denial of service (heap-based out-of-bounds read and applicatCVE-2018-113775.5The avr_op_analyze() function in radare2 2.5.0 allows remote attackers to cause a denial of service (heap-based out-of-bounds read and appliCVE-2018-113787.8The wasm_dis() function in libr/asm/arch/wasm/wasm.c in or possibly have unspecified other impact via a crafted WASM file.CVE-2018-113795.5The get_debug_info() function in radare2 2.5.0 allows remote attackers to cause a denial of service (heap-based out-of-bounds read and appliCVE-2018-113805.5The parse_import_ptr() function in radare2 2.5.0 allows remote attackers to cause a denial of service (heap-based out-of-bounds read and appCVE-2018-113815.5The string_scan_range() function in radare2 2.5.0 allows remote attackers to cause a denial of service (heap-based out-of-bounds read and apCVE-2018-113825.5The _inst__sts() function in radare2 2.5.0 allows remote attackers to cause a denial of service (heap-based out-of-bounds read and applicatiCVE-2018-113835.5The r_strbuf_fini() function in radare2 2.5.0 allows remote attackers to cause a denial of service (invalid free and application crash) via
CVE-2018-1137: High severity, CVSS 8.1 | Vulnix