CVSS: 6.1EPSS: 0%CPEs: 4EXPL: 0CVE-2019-3850
https://notcve.org/view.php?id=CVE-2019-3850
A vulnerability was found in moodle before versions 3.6.3, 3.5.5, 3.4.8 and 3.1.17. Links within assignment submission comments would open directly (in the same window). Although links themselves may be valid, opening within the same window and without the no-referrer header policy made them more susceptible to exploits. Se ha detectado una vulnerabilidad en moodle, en versiones anteriores a la 3.6.3, 3.5.5, 3.4.8 y 3.1.17. Los enlaces con comentarios de envío de tareas se abrirían directamente (en la misma ventana). • https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3850 https://moodle.org/mod/forum/discuss.php?d=384013#p1547745 • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 8.8EPSS: 0%CPEs: 3EXPL: 0CVE-2019-3849
https://notcve.org/view.php?id=CVE-2019-3849
A vulnerability was found in moodle before versions 3.6.3, 3.5.5 and 3.4.8. Users could assign themselves an escalated role within courses or content accessed via LTI, by modifying the request to the LTI publisher site. Se ha detectado una vulnerabilidad en moodle, en versiones anteriores a la 3.6.3, 3.5.5 y 3.4.8. Los usuarios podrían autoasignarse un rol escalado en los cursos o el contenido al que se accede mediante LTI modificando la petición al sitio LTI del editor. • https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3849 https://moodle.org/mod/forum/discuss.php?d=384012#p1547744 • CWE-269: Improper Privilege Management CWE-285: Improper Authorization •
CVSS: 4.3EPSS: 0%CPEs: 3EXPL: 0CVE-2019-3848
https://notcve.org/view.php?id=CVE-2019-3848
A vulnerability was found in moodle before versions 3.6.3, 3.5.5 and 3.4.8. Permissions were not correctly checked before loading event information into the calendar's edit event modal popup, so logged in non-guest users could view unauthorised calendar events. (Note: It was read-only access, users could not edit the events.) Se ha detectado una vulnerabilidad en moodle, en versiones anteriores a la 3.6.3, 3.5.5 y 3.4.8. Los permisos no se comprobaban correctamente antes de cargar información de eventos en la ventana emergente modal de edición de eventos del calendario, por lo que los usuarios no invitados que hayan iniciado sesión podrían visualizar eventos de calendario no autorizados. • https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3848 https://moodle.org/mod/forum/discuss.php?d=384011#p1547743 • CWE-863: Incorrect Authorization •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2019-3809
https://notcve.org/view.php?id=CVE-2019-3809
A flaw was found in Moodle versions 3.1 to 3.1.15 and earlier unsupported versions. The mybackpack functionality allowed setting the URL of badges, when it should be restricted to the Mozilla Open Badges backpack URL. This resulted in the possibility of blind SSRF via requests made by the page. Se ha encontrado un error en Moodle, en versiones 3.1 a 3.1.15 y versiones anteriores sin soporte. La funcionalidad ‘‘mybackpack’’ ha permitido establecer la URL de las insignias cuando debería estar restringida la URL del ‘‘backpack’’ de Mozilla Open Badges. • http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-64222 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3809 https://moodle.org/mod/forum/discuss.php?d=381229#p1536766 • CWE-352: Cross-Site Request Forgery (CSRF) CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 5.4EPSS: 0%CPEs: 5EXPL: 0CVE-2019-3808
https://notcve.org/view.php?id=CVE-2019-3808
A flaw was found in Moodle versions 3.6 to 3.6.1, 3.5 to 3.5.3, 3.4 to 3.4.6, 3.1 to 3.1.15 and earlier unsupported versions. The 'manage groups' capability did not have the 'XSS risk' flag assigned to it, but does have that access in certain places. Note that the capability is intended for use by trusted users, and is only assigned to teachers and managers by default. Se ha encontrado un error en Moodle, en versiones 3.4 a 3.6.1, 3.3 a 3.5.3, 3.2 a 3.4.6 y 3.1 a 3.1.15, así como en versiones anteriores sin soporte. La funcionalidad ‘‘manage groups’’ no tenía el flag ‘‘XSS risk’’ asignado, pero tiene ese tipo de acceso a ciertos lugares. • http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-64395 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3808 https://moodle.org/mod/forum/discuss.php?d=381228#p1536765 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •