HTML Block Vulnerability in Moodle 3.x by Moodle

CVE-2018-1136

What is CVE-2018-1136?

An issue was identified in Moodle 3.x that allows authenticated users to add HTML blocks containing scripts to their personal Dashboards. This typically poses no security risk as the Dashboard is private to the user. However, exploiting this vulnerability permits these users to transfer such blocks to shared pages, making them visible to other users. Consequently, this opens the door for potential script injection vulnerabilities, compromising the application's integrity and user data.

References