8.1

CVSS Score

3.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2018-1137

CVE-2018-1137: Moodle Portfolio script allows instantiation of class chosen by user

An issue was discovered in Moodle 3.x. By substituting URLs in portfolios, users can instantiate any class. This can also be exploited by users who are logged in as guests to create a DDoS attack.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2018-1137

CVE-2018-1137:

8.1

CVSS Score

3.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
moodle/moodle	composer	>= 3.1, < 3.1.12	3.1.12
moodle/moodle	composer	>= 3.2, < 3.2.9	3.2.9
moodle/moodle	composer	>= 3.3, < 3.3.6	3.3.6
moodle/moodle	composer	>= 3.4, < 3.4.3	3.4.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability stems from improper input validation in portfolio handling code. Moodle's portfolio system allowed user-controlled 'portfolio' parameters to directly determine which class to instantiate. The functions in portfolio/export.php that handle these requests would:

Accept user-supplied class names via URL parameters
Instantiate them without verifying if they're valid portfolio classes
Enable attackers to instantiate arbitrary classes (including non-portfolio classes)

This matches the CWE-20 pattern and explains both the DDoS potential (through resource-intensive class instantiation) and the arbitrary class execution risk. The file paths and function names are consistent with Moodle's portfolio architecture and vulnerability description, though exact implementation details are inferred from security advisory patterns.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.