Staging Environment: Content and features may be unstable or change without notice.
Advisory details: ubuntu_osv / UBUNTU-CVE-2013-3630
Advisory ID ubuntu_osv/UBUNTU-CVE-2013-3630
Aliases CVE-2013-3630
Summary Moodle through 2.5.2 allows remote authenticated administrators to execute arbitrary programs by configuring the aspell pathname and then triggering a spell-check operation within the TinyMCE editor.
Status Published
Exploitability 2.0
Weighted Severity 6.2
Risk 10.0
Affected and Fixed Packages Package Details
Introduced and Fixed Package Commit Patches Package Commit Patches Details
Weaknesses (0)
There are no known CWE.
System Score Found at
ubuntu-priority medium https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2013/UBUNTU-CVE-2013-3630.json
Reference id Reference type URL
https://community.rapid7.com/community/metasploit/blog/2013/10/30/seven-foss-disclosures-part-one
https://community.rapid7.com/community/metasploit/blog/2013/10/30/seven-tricks-and-treats
https://tracker.moodle.org/browse/MDL-41449
https://ubuntu.com/security/CVE-2013-3630
https://www.cve.org/CVERecord?id=CVE-2013-3630
Data source Exploit-DB
Date added Oct. 31, 2013
Description Moodle - Remote Command Execution (Metasploit)
Ransomware campaign use Known
Source publication date Oct. 31, 2013
Exploit type remote
Platform linux
Source update date Oct. 31, 2013
Data source Metasploit
Description Moodle allows an authenticated user to define spellcheck settings via the web interface. The user can update the spellcheck mechanism to point to a system-installed aspell binary. By updating the path for the spellchecker to an arbitrary command, an attacker can run arbitrary commands in the context of the web application upon spellchecking requests. This module also allows an attacker to leverage another privilege escalation vuln. Using the referenced XSS vuln, an unprivileged authenticated user can steal an admin sesskey and use this to escalate privileges to that of an admin, allowing the module to pop a shell as a previously unprivileged authenticated user. This module was tested against Moodle version 2.5.2 and 2.2.3.
Note 
Stability:
  - crash-safe
Reliability:
  - repeatable-session
SideEffects:
  - config-changes
  - ioc-in-logs
Ransomware campaign use Unknown
Source publication date Oct. 30, 2013
Platform Linux,Unix
Source URL https://github.com/rapid7/metasploit-framework/tree/master/modules/exploits/multi/http/moodle_spelling_binary_rce.rb

No EPSS data available for this advisory.

Patch URL
There are no known patches.

There are no known vectors.

There are no SSVC decisions available.