PT-2019-16742 · Moodle · Moodle

Juan Leyva · Published 2019-03-26 · Updated 2022-11-07 · CVE-2019-3848

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Moodle versions prior to 3.6.3 Moodle versions prior to 3.5.5 Moodle versions prior to 3.4.8

Description A vulnerability was found where permissions were not correctly checked before loading event information into the calendar's edit event modal popup. This allowed logged in non-guest users to view unauthorized calendar events, although it was read-only access and users could not edit the events.

Recommendations For versions prior to 3.6.3, update to version 3.6.3 or later. For versions prior to 3.5.5, update to version 3.5.5 or later. For versions prior to 3.4.8, update to version 3.4.8 or later.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2019-3848

GHSA-45RW-4R25-JVG7

Affected Products

Moodle

References · 6

• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3848 · Patch
• https://osv.dev/vulnerability/CVE-2019-3848 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-45rw-4r25-jvg7 · Vendor Advisory
• https://moodle.org/mod/forum/discuss.php?d=384011#p1547743 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-3848 · Security Note
• https://github.com/moodle/moodle · Note