Moodle 3.x
10 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2018-1045 | Moodle 3.x | In Moodle 3.x, there is XSS via a calendar event name. | MEDIUM 5.4 | 1.0 % | ||
| CVE-2018-1044 | Moodle 3.x | In Moodle 3.x, quiz web services allow students to see quiz results when it is prohibited in the settings. | MEDIUM 4.3 | 1.1 % | ||
| CVE-2018-1043 | Moodle 3.x | In Moodle 3.x, the setting for blocked hosts list can be bypassed with multiple A record hostnames. | MEDIUM 6.5 | 1.5 % | ||
| CVE-2018-1042 | Moodle 3.x | Moodle 3.x has Server Side Request Forgery in the filepicker. | MEDIUM 6.5 | 16 % | ||
| CVE-2017-15110 | Moodle 3.x | In Moodle 3.x, students can find out email addresses of other students in the same course. Using search on the Participants page, students c | MEDIUM 4.3 | 1.2 % | ||
| CVE-2017-12157 | Moodle 3.x | In Moodle 3.x, various course reports allow teachers to view details about users in the groups they can't access. | MEDIUM 4.3 | 1.1 % | ||
| CVE-2017-12156 | Moodle 3.x | Moodle 3.x has XSS in the contact form on the "non-respondents" page in non-anonymous feedback. | MEDIUM 6.1 | 1.2 % | ||
| CVE-2017-2645 | Moodle 3.x | In Moodle 3.x, XSS can occur via attachments to evidence of prior learning. | MEDIUM 6.1 | 1.1 % | ||
| CVE-2017-2644 | Moodle 3.x | In Moodle 3.x, XSS can occur via evidence of prior learning. | MEDIUM 6.1 | 1.1 % | ||
| CVE-2017-2578 | Moodle 3.x | In Moodle 3.x, there is XSS in the assignment submission page. | MEDIUM 6.1 | 0.9 % |