CVE-2020-10738: 
PHP vulnerability analysis and mitigation

A critical vulnerability (CVE-2020-10738) was discovered in Moodle versions 3.8 before 3.8.3, 3.7 before 3.7.6, 3.6 before 3.6.10, 3.5 before 3.5.12 and earlier unsupported versions. The vulnerability allowed attackers to achieve remote code execution by creating a specially crafted SCORM package that could be interacted with via web services when added to a course (Moodle Forum, NVD).

The vulnerability was classified with a CVSS v3.1 Base Score of 8.8 (HIGH) by NVD with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating network accessibility, low attack complexity, and requiring low privileges. Red Hat assessed it with a slightly lower score of 7.5 (HIGH) with vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, suggesting higher attack complexity. The vulnerability is categorized under CWE-20 (Improper Input Validation) (NVD).

The vulnerability could allow attackers to execute arbitrary code remotely on affected Moodle installations through maliciously crafted SCORM packages. This could potentially lead to complete system compromise, with high impacts on confidentiality, integrity, and availability of the affected system (NVD).

The vulnerability requires low privileges and no user interaction to exploit, making it relatively accessible to attackers. The attack can be launched remotely through network access, though Red Hat's assessment suggests higher attack complexity is required (NVD).

A temporary workaround is to disable the 'SCORM package' activity type until the security patch can be applied. The vulnerability has been fixed in Moodle versions 3.8.3, 3.7.6, 3.6.10, and 3.5.12. Users are advised to upgrade to these or later versions (Moodle Forum).