CVE-2018-1136

An issue was discovered in Moodle 3.x. An authenticated user is allowed to add HTML blocks containing scripts to their Dashboard; this is normally not a security issue because a personal dashboard is visible to this user only. Through this security vulnerability, users can move such a block to other pages where they can be viewed by other users.

Score

CVSS 3.0 4.3 Medium

Status

Modified - secalert@redhat.com

Published

2018-05-25

Last modified

2024-08-05

Weaknesses

CWE-79

Affected products

• Moodle (Moodle)

References

• http://www.securityfocus.com/bid/104307
• https://moodle.org/mod/forum/discuss.php?d=371202