Vulnerability Description
Moodle through 2.5.2 allows remote authenticated administrators to execute arbitrary programs by configuring the aspell pathname and then triggering a spell-check operation within the TinyMCE editor.
CVSS Score
4.6
MEDIUM
AV:N/AC:H/Au:S/C:P/I:P/A:P
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Moodle | Moodle | <= 2.5.2 |
Related Weaknesses (CWE)
References
- http://packetstormsecurity.com/files/164479/Moodle-Authenticated-Spelling-Binary
- https://community.rapid7.com/community/metasploit/blog/2013/10/30/seven-foss-dis
- https://community.rapid7.com/community/metasploit/blog/2013/10/30/seven-tricks-aExploit
- http://packetstormsecurity.com/files/164479/Moodle-Authenticated-Spelling-Binary
- https://community.rapid7.com/community/metasploit/blog/2013/10/30/seven-foss-dis
- https://community.rapid7.com/community/metasploit/blog/2013/10/30/seven-tricks-aExploit
FAQ
What is CVE-2013-3630?
CVE-2013-3630 is a vulnerability with a CVSS score of 4.6 (MEDIUM). Moodle through 2.5.2 allows remote authenticated administrators to execute arbitrary programs by configuring the aspell pathname and then triggering a spell-check operation within the TinyMCE editor.
How severe is CVE-2013-3630?
CVE-2013-3630 has been rated MEDIUM with a CVSS base score of 4.6/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2013-3630?
Check the references section above for vendor advisories and patch information. Affected products include: Moodle Moodle.