PT-2020-9620 · Moodle+1 · Moodle+1

Yuri Zwaig · Published 2019-09-11 · Updated 2022-05-24 · CVE-2019-14881

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions moodle versions 3.7 through 3.7.2 moodle versions prior to 3.7.3

Description A blind XSS issue is present in certain locations where user email is displayed. This allows for reflected XSS attacks.

Recommendations For moodle versions 3.7 through 3.7.2, update to version 3.7.3 or later. For moodle versions prior to 3.7.3, update to version 3.7.3 or later. As a temporary workaround, consider restricting access to locations where user email is displayed until a patch is available.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

ALT-PU-2019-2681

ALT-PU-2019-2843

CVE-2019-14881

GHSA-9JF6-WQ34-FG9W

Affected Products

Alt Linux

Moodle

References · 11

• https://osv.dev/vulnerability/GHSA-9jf6-wq34-fg9w · Vendor Advisory
• https://moodle.org/mod/forum/discuss.php?d=393584#p1586746 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-14881 · Security Note
• https://osv.dev/vulnerability/CVE-2019-14881 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2019-14881 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-14881 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-14881 · Vendor Advisory
• https://github.com/moodle/moodle · Note
• https://github.com/moodle/moodle/commit/7455b741c954af3c3e7dfda2972edc1146ea1562 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14881 · Note
• https://t.me/cvenotify/1843 · Telegram Post