PT-2019-16745 · Moodle · Moodle

Luca Bösch + 1 · Published 2019-03-26 · Updated 2022-05-13 · CVE-2019-3851

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Moodle versions prior to 3.6.3 Moodle versions prior to 3.5.5

Description A vulnerability was found where a link to the site home within the Boost theme's secure layout allowed students to navigate out of the page.

Recommendations For versions prior to 3.6.3, update to version 3.6.3 or later. For versions prior to 3.5.5, update to version 3.5.5 or later.

Fix

Related Identifiers

CVE-2019-3851

GHSA-PJ45-HP8H-289R

Affected Products

Moodle

References · 9

• https://moodle.org/mod/forum/discuss.php?d=384014#p1547746 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-3851 · Security Note
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3851 · Patch
• https://osv.dev/vulnerability/CVE-2019-3851 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-pj45-hp8h-289r · Vendor Advisory
• https://github.com/moodle/moodle · Note
• https://github.com/moodle/moodle/commit/911f7488068a56b05b0ad87be8f9e132075ab0a6 · Note
• https://github.com/moodle/moodle/commit/7f22b14efb3408645cede026ad11126f17e3f59a · Note
• https://github.com/moodle/moodle/commit/c430bed525c4c7e6e5a1c0f7222bc323cf9b6245 · Note