PT-2019-16742 · Moodle · Moodle

Juan Leyva · Publicado 2019-03-26 · Atualizado 2022-11-07 · CVE-2019-3848

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Moodle versions prior to 3.6.3 Moodle versions prior to 3.5.5 Moodle versions prior to 3.4.8

Description A vulnerability was found where permissions were not correctly checked before loading event information into the calendar's edit event modal popup. This allowed logged in non-guest users to view unauthorized calendar events, although it was read-only access and users could not edit the events.

Recommendations For versions prior to 3.6.3, update to version 3.6.3 or later. For versions prior to 3.5.5, update to version 3.5.5 or later. For versions prior to 3.4.8, update to version 3.4.8 or later.

Correção

Incorrect Authorization

Enumeração de Fraquezas

CWE-863

Identificadores relacionados

CVE-2019-3848

GHSA-45RW-4R25-JVG7

Produtos afetados

Moodle

Referências · 6

• https://github.com/moodle/moodle · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-3848 · Nota de Segurança
• https://moodle.org/mod/forum/discuss.php?d=384011#p1547743 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-45rw-4r25-jvg7 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2019-3848 · Aviso do Fabricante
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3848 · Correção