An issue was discovered in Moodle 3.x. A Teacher creating a Calculated question can intentionally cause remote code execution on the server, aka eval injection.
{
"cpe": "cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*",
"source": "CPE_RANGE",
"extracted_events": [
{
"introduced": "3.1.0"
},
{
"last_affected": "3.1.11"
},
{
"introduced": "3.2.0"
},
{
"last_affected": "3.2.8"
},
{
"introduced": "3.3.0"
},
{
"last_affected": "3.3.5"
},
{
"introduced": "3.4.0"
},
{
"last_affected": "3.4.2"
}
]
}