CVE-2018-10890: Moodle

Medium severity, CVSS 5.3. EPSS: 2.1% chance of exploitation in the next 30 days.

A flaw was found in moodle before versions 3.5.1, 3.4.4, 3.3.7, 3.1.13. It was possible for the core_course_get_categories web service to return hidden categories, which should be omitted when fetching course categories.

Affected products

• Moodle Moodle: from 3.1.0, before 3.1.13 (fixed in 3.1.13); from 3.3.0, before 3.3.7 (fixed in 3.3.7); from 3.4.0, before 3.4.4 (fixed in 3.4.4); from 3.5.0, before 3.5.1 (fixed in 3.5.1)

Published 2018-07-10. Last modified 2026-06-17.