Log in Start free

Vulnerability · Published May 21, 2020 · Assigned by redhat

CVE-2020-10738

High 7.5

In plain English

A high-severity improper input validation in moodle from [UNKNOWN]. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.0% (higher than 87% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)3.0%top 12.6% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

A flaw was found in Moodle versions 3.8 before 3.8.3, 3.7 before 3.7.6, 3.6 before 3.6.10, 3.5 before 3.5.12 and earlier unsupported versions. It was possible to create a SCORM package in such a way that when added to a course, it could be interacted with via web services in order to achieve remote code execution.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Packagistmoodle/moodle3.8.3GHSA-vr6v-g96p-cjc3
Packagistmoodle/moodle3.7.6GHSA-vr6v-g96p-cjc3
Packagistmoodle/moodle3.6.10GHSA-vr6v-g96p-cjc3
Packagistmoodle/moodle3.5.12GHSA-vr6v-g96p-cjc3

Affected products (as reported)

VendorProductVersions
[UNKNOWN] moodle 3.8 to 3.8.23.7 to 3.7.53.6 to 3.6.93.5 to 3.5.11Earlier unsupported versions.

Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

References