PT-2020-9619 · Moodle+1 · Moodle+1

Dhananjay Arunesh · Published 2019-11-16 · Updated 2022-05-24 · CVE-2019-14880

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Moodle versions 3.7 before 3.7.3 Moodle versions 3.6 before 3.6.7 Moodle versions 3.5 before 3.5.9 and earlier

Description A vulnerability was found in Moodle. OAuth 2 providers who do not verify users' email address changes require additional verification during sign-up to reduce the risk of account compromise.

Recommendations For Moodle versions 3.7 before 3.7.3, update to version 3.7.3 or later. For Moodle versions 3.6 before 3.6.7, update to version 3.6.7 or later. For Moodle versions 3.5 before 3.5.9 and earlier, update to version 3.5.9 or later. As a temporary workaround, consider requiring additional verification during sign-up for OAuth 2 providers who do not verify users' email address changes.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

ALT-PU-2019-3145

ALT-PU-2020-1250

CVE-2019-14880

GHSA-RV62-6F56-J83W

Affected Products

Alt Linux

Moodle

References · 10

• https://osv.dev/vulnerability/GHSA-rv62-6f56-j83w · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-14880 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-14880 · Security Note
• https://moodle.org/security · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2019-14880 · Security Note
• https://ubuntu.com/security/CVE-2019-14880 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-14880 · Vendor Advisory
• https://github.com/moodle/moodle · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14880 · Note
• https://t.me/cibsecurity/10886 · Telegram Post