PT-2019-16734 · Moodle · Moodle

Fariskhi Vidyan · Publicado 2019-03-25 · Atualizado 2022-05-13 · CVE-2019-3808

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Moodle versions 3.1 to 3.1.15 Moodle versions 3.4 to 3.4.6 Moodle versions 3.5 to 3.5.3 Moodle versions 3.6 to 3.6.1

Description A flaw was found in the 'manage groups' capability, which did not have the 'XSS risk' flag assigned to it, despite having access in certain places. This capability is intended for use by trusted users and is assigned to teachers and managers by default.

Recommendations For Moodle versions 3.1 to 3.1.15, update to a version later than 3.1.15 to resolve the issue. For Moodle versions 3.4 to 3.4.6, update to a version later than 3.4.6 to resolve the issue. For Moodle versions 3.5 to 3.5.3, update to a version later than 3.5.3 to resolve the issue. For Moodle versions 3.6 to 3.6.1, update to a version later than 3.6.1 to resolve the issue.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2019-3808

GHSA-4R2P-WPV5-683W

Produtos afetados

Moodle

Referências · 11

• https://github.com/moodle/moodle · Nota
• https://github.com/moodle/moodle/commit/6360f87cdca744a6a71c315853f6d811a3e54e26 · Nota
• http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-64395 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-3808 · Nota de Segurança
• https://cve.org/CVERecord?id=CVE-2019-3808 · Nota de Segurança
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3808 · Correção
• https://osv.dev/vulnerability/GHSA-4r2p-wpv5-683w · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2019-3808 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2019-3808 · Aviso do Fabricante
• https://moodle.org/mod/forum/discuss.php?d=381228#p1536765 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-3808 · Aviso do Fabricante