PT-2019-16734 · Moodle · Moodle

Fariskhi Vidyan · Published 2019-03-25 · Updated 2022-05-13 · CVE-2019-3808

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Moodle versions 3.1 to 3.1.15 Moodle versions 3.4 to 3.4.6 Moodle versions 3.5 to 3.5.3 Moodle versions 3.6 to 3.6.1

Description A flaw was found in the 'manage groups' capability, which did not have the 'XSS risk' flag assigned to it, despite having access in certain places. This capability is intended for use by trusted users and is assigned to teachers and managers by default.

Recommendations For Moodle versions 3.1 to 3.1.15, update to a version later than 3.1.15 to resolve the issue. For Moodle versions 3.4 to 3.4.6, update to a version later than 3.4.6 to resolve the issue. For Moodle versions 3.5 to 3.5.3, update to a version later than 3.5.3 to resolve the issue. For Moodle versions 3.6 to 3.6.1, update to a version later than 3.6.1 to resolve the issue.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-3808

GHSA-4R2P-WPV5-683W

Affected Products

Moodle

References · 11

• http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-64395 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-3808 · Security Note
• https://cve.org/CVERecord?id=CVE-2019-3808 · Security Note
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3808 · Patch
• https://osv.dev/vulnerability/GHSA-4r2p-wpv5-683w · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-3808 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-3808 · Vendor Advisory
• https://moodle.org/mod/forum/discuss.php?d=381228#p1536765 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-3808 · Vendor Advisory
• https://github.com/moodle/moodle · Note
• https://github.com/moodle/moodle/commit/6360f87cdca744a6a71c315853f6d811a3e54e26 · Note