PT-2019-16743 · Moodle · Moodle

Brendan Cox · Publicado 2019-03-26 · Atualizado 2022-05-13 · CVE-2019-3849

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Moodle versions prior to 3.6.3 Moodle versions prior to 3.5.5 Moodle versions prior to 3.4.8

Description A vulnerability was found that allows users to assign themselves an escalated role within courses or content accessed via LTI. This is achieved by modifying the request to the LTI publisher site.

Recommendations For versions prior to 3.6.3, update to version 3.6.3 or later. For versions prior to 3.5.5, update to version 3.5.5 or later. For versions prior to 3.4.8, update to version 3.4.8 or later.

Correção

Improper Authorization

Improper Privilege Management

Enumeração de Fraquezas

CWE-285

CWE-269

Identificadores relacionados

CVE-2019-3849

GHSA-5WG9-5W3F-HXMH

Produtos afetados

Moodle

Referências · 13

• https://github.com/moodle/moodle · Nota
• https://github.com/moodle/moodle/commit/cd3060d941a051931eb2613b25bafb0108665895 · Nota
• https://github.com/moodle/moodle/commit/898d5d05a0c3ae6795db0241bf3cb5951213d45c · Nota
• https://github.com/moodle/moodle/commit/723d1a747555b795ed53a0fad01da455797bb78f · Nota
• https://github.com/moodle/moodle/commit/430f685834cef190bdf58afabe79e765d596890d · Nota
• https://github.com/moodle/moodle/commit/427463a52574e4b3bcbe1c65c49066438770641e · Nota
• https://github.com/moodle/moodle/commit/b77dcd23d8e39265b5c096f0d947764c02d832c8 · Nota
• https://github.com/moodle/moodle/commit/fba7dcd90abd45210d782a79c6e25bb3840c7438 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-3849 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-3849 · Aviso do Fabricante
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3849 · Correção
• https://moodle.org/mod/forum/discuss.php?d=384012#p1547744 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-5wg9-5w3f-hxmh · Aviso do Fabricante