PT-2019-16743 · Moodle · Moodle

Brendan Cox · Published 2019-03-26 · Updated 2022-05-13 · CVE-2019-3849

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Moodle versions prior to 3.6.3 Moodle versions prior to 3.5.5 Moodle versions prior to 3.4.8

Description A vulnerability was found that allows users to assign themselves an escalated role within courses or content accessed via LTI. This is achieved by modifying the request to the LTI publisher site.

Recommendations For versions prior to 3.6.3, update to version 3.6.3 or later. For versions prior to 3.5.5, update to version 3.5.5 or later. For versions prior to 3.4.8, update to version 3.4.8 or later.

Fix

Improper Authorization

Improper Privilege Management

Weakness Enumeration

CWE-285

CWE-269

Related Identifiers

CVE-2019-3849

GHSA-5WG9-5W3F-HXMH

Affected Products

Moodle

References · 13

• https://nvd.nist.gov/vuln/detail/CVE-2019-3849 · Security Note
• https://osv.dev/vulnerability/CVE-2019-3849 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3849 · Patch
• https://moodle.org/mod/forum/discuss.php?d=384012#p1547744 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-5wg9-5w3f-hxmh · Vendor Advisory
• https://github.com/moodle/moodle · Note
• https://github.com/moodle/moodle/commit/cd3060d941a051931eb2613b25bafb0108665895 · Note
• https://github.com/moodle/moodle/commit/898d5d05a0c3ae6795db0241bf3cb5951213d45c · Note
• https://github.com/moodle/moodle/commit/723d1a747555b795ed53a0fad01da455797bb78f · Note
• https://github.com/moodle/moodle/commit/430f685834cef190bdf58afabe79e765d596890d · Note
• https://github.com/moodle/moodle/commit/427463a52574e4b3bcbe1c65c49066438770641e · Note
• https://github.com/moodle/moodle/commit/b77dcd23d8e39265b5c096f0d947764c02d832c8 · Note
• https://github.com/moodle/moodle/commit/fba7dcd90abd45210d782a79c6e25bb3840c7438 · Note