PT-2019-11600 · Moodle+1 · Moodle+1

Mazen Gamal · Published 2019-06-18 · Updated 2022-05-24 · CVE-2019-10154

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Moodle versions prior to 3.7 Moodle versions prior to 3.6.4

Description: A flaw was found in a web service that fetches messages, which was not restricted to the current user's conversations.

Recommendations: For versions prior to 3.7, update to version 3.7 or later. For versions prior to 3.6.4, update to version 3.6.4 or later.

Fix

Improper Authorization

Weakness Enumeration

CWE-285

Related Identifiers

ALT-PU-2019-2080

ALT-PU-2019-2096

CVE-2019-10154

GHSA-WW45-X87C-WGFF

Affected Products

Alt Linux

Moodle

References · 8

• https://osv.dev/vulnerability/GHSA-ww45-x87c-wgff · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-10154 · Security Note
• https://moodle.org/mod/forum/discuss.php?d=386521 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-10154 · Vendor Advisory
• https://github.com/moodle/moodle · Note
• https://github.com/moodle/moodle/commit/2904a7f851da8e66be12f41d55068bf07817fbd6 · Note
• https://github.com/moodle/moodle/commit/a3d19efab4aff83c07db9f0ad34c8f0e1f29c64c · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10154 · Note