CVE-2018-14630

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

moodle before versions 3.5.2, 3.4.5, 3.3.8, 3.1.14 is vulnerable to an XML import of ddwtos could lead to intentional remote code execution. When importing legacy 'drag and drop into text' (ddwtos) type quiz questions, it was possible to inject and execute PHP code from within the imported questions, either intentionally or by importing questions from an untrusted source.

Metrics

CVSS 3.0 8.8/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-20 CWE-94

Affected software

Vendor	Product	Versions
[UNKNOWN]	moodle	3.5.2; 3.4.5; 3.3.8; 3.1.14

References

http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-62880Patch, Vendor Advisory
http://www.securityfocus.com/bid/105354Third Party Advisory, VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14630Issue Tracking, Patch, Third Party Advisory
https://moodle.org/mod/forum/discuss.php?d=376023Patch, Vendor Advisory
https://seclists.org/fulldisclosure/2018/Sep/28Exploit, Mailing List, Third Party Advisory
https://www.sec-consult.com/en/blog/advisories/remote-code-execution-php-unserialize-moodle-open-source-learning-platform-cve-2018-14630/Exploit, Third Party Advisory
http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-62880Patch, Vendor Advisory
http://www.securityfocus.com/bid/105354Third Party Advisory, VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14630Issue Tracking, Patch, Third Party Advisory
https://moodle.org/mod/forum/discuss.php?d=376023Patch, Vendor Advisory
https://seclists.org/fulldisclosure/2018/Sep/28Exploit, Mailing List, Third Party Advisory
https://www.sec-consult.com/en/blog/advisories/remote-code-execution-php-unserialize-moodle-open-source-learning-platform-cve-2018-14630/Exploit, Third Party Advisory

Timeline

Published: Sep 17, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-146316.1moodle before versions 3.5.2, 3.4.5, 3.3.8 is vulnerable to a boost theme - blog search GET parameter insufficiently filtered. The breadcrum CVE-2018-146327.7An out of bound write can occur when patching an Openshift object using the 'oc patch' functionality in OpenShift Container Platform before CVE-2018-146337.0A security flaw was found in the chap_server_compute_md5() function in the ISCSI target code in the Linux kernel in a way an authentication CVE-2018-146347.8An integer overflow flaw was found in the Linux kernel's create_elf_tables() function. An unprivileged local user with access to SUID (or ot CVE-2018-146356.5When using the Linux bridge ml2 driver, non-privileged tenants are able to create and attach ports without specifying an IP address, bypassi CVE-2018-146365.3Live-migrated instances are briefly able to inspect traffic for other instances on the same hypervisor. This brief window could be extended CVE-2018-146378.1The SAML broker consumer endpoint in Keycloak before version 4.6.0.Final ignores expiration conditions on SAML assertions. An attacker can e CVE-2018-146387.5A flaw was found in 389-ds-base before version 1.3.8.4-13. The process ns-slapd crashes in delete_passwdPolicy function when persistent sear CVE-2018-14646.5IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products ( 6.1, 6.2, 6.3, 6.4, 7.1, 7.2, 7.3, 7.4, 7.5,CVE-2018-146415.9A security flaw was found in the ip_frag_reasm() function in net/ipv4/ip_fragment.c in the Linux kernel from 4.19-rc1 to 4.19-rc3 inclusive,CVE-2018-146425.3An information leak vulnerability was found in Undertow. If all headers are not written out in the first write() call then the code that han CVE-2018-146439.8An authentication bypass flaw was found in the smart_proxy_dynflow component used by Foreman. A malicious attacker can use this flaw to remo