CVSS: 6.1EPSS: 0%CPEs: 4EXPL: 0CVE-2019-3850
https://notcve.org/view.php?id=CVE-2019-3850
A vulnerability was found in moodle before versions 3.6.3, 3.5.5, 3.4.8 and 3.1.17. Links within assignment submission comments would open directly (in the same window). Although links themselves may be valid, opening within the same window and without the no-referrer header policy made them more susceptible to exploits. Se ha detectado una vulnerabilidad en moodle, en versiones anteriores a la 3.6.3, 3.5.5, 3.4.8 y 3.1.17. Los enlaces con comentarios de envío de tareas se abrirían directamente (en la misma ventana). • https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3850 https://moodle.org/mod/forum/discuss.php?d=384013#p1547745 • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 8.8EPSS: 0%CPEs: 3EXPL: 0CVE-2019-3849
https://notcve.org/view.php?id=CVE-2019-3849
A vulnerability was found in moodle before versions 3.6.3, 3.5.5 and 3.4.8. Users could assign themselves an escalated role within courses or content accessed via LTI, by modifying the request to the LTI publisher site. Se ha detectado una vulnerabilidad en moodle, en versiones anteriores a la 3.6.3, 3.5.5 y 3.4.8. Los usuarios podrían autoasignarse un rol escalado en los cursos o el contenido al que se accede mediante LTI modificando la petición al sitio LTI del editor. • https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3849 https://moodle.org/mod/forum/discuss.php?d=384012#p1547744 • CWE-269: Improper Privilege Management CWE-285: Improper Authorization •
CVSS: 4.3EPSS: 0%CPEs: 3EXPL: 0CVE-2019-3848
https://notcve.org/view.php?id=CVE-2019-3848
A vulnerability was found in moodle before versions 3.6.3, 3.5.5 and 3.4.8. Permissions were not correctly checked before loading event information into the calendar's edit event modal popup, so logged in non-guest users could view unauthorised calendar events. (Note: It was read-only access, users could not edit the events.) Se ha detectado una vulnerabilidad en moodle, en versiones anteriores a la 3.6.3, 3.5.5 y 3.4.8. Los permisos no se comprobaban correctamente antes de cargar información de eventos en la ventana emergente modal de edición de eventos del calendario, por lo que los usuarios no invitados que hayan iniciado sesión podrían visualizar eventos de calendario no autorizados. • https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3848 https://moodle.org/mod/forum/discuss.php?d=384011#p1547743 • CWE-863: Incorrect Authorization •
CVSS: 5.4EPSS: 0%CPEs: 5EXPL: 0CVE-2019-3808
https://notcve.org/view.php?id=CVE-2019-3808
A flaw was found in Moodle versions 3.6 to 3.6.1, 3.5 to 3.5.3, 3.4 to 3.4.6, 3.1 to 3.1.15 and earlier unsupported versions. The 'manage groups' capability did not have the 'XSS risk' flag assigned to it, but does have that access in certain places. Note that the capability is intended for use by trusted users, and is only assigned to teachers and managers by default. Se ha encontrado un error en Moodle, en versiones 3.4 a 3.6.1, 3.3 a 3.5.3, 3.2 a 3.4.6 y 3.1 a 3.1.15, así como en versiones anteriores sin soporte. La funcionalidad ‘‘manage groups’’ no tenía el flag ‘‘XSS risk’’ asignado, pero tiene ese tipo de acceso a ciertos lugares. • http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-64395 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3808 https://moodle.org/mod/forum/discuss.php?d=381228#p1536765 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 1%CPEs: 4EXPL: 3CVE-2019-3810 – Moodle 3.6.1 - Persistent Cross-Site Scripting (XSS)
https://notcve.org/view.php?id=CVE-2019-3810
A flaw was found in moodle versions 3.6 to 3.6.1, 3.5 to 3.5.3, 3.4 to 3.4.6, 3.1 to 3.1.15 and earlier unsupported versions. The /userpix/ page did not escape users' full names, which are included as text when hovering over profile images. Note this page is not linked to by default and its access is restricted. Se ha encontrado un error en Moodle, desde la versión 3.6 hasta la 3.6.1, de la 3.5 a la 3.5.3, de la 3.4 a la 3.4.6 y desde la 3.1 hasta la 3.1.15, así como en versiones anteriores sin soporte. La página /userprix/ no escapó los nombres completos de los usuarios, que están incluidos como texto al desplazarse sobre las imágenes. • https://www.exploit-db.com/exploits/49814 https://github.com/farisv/Moodle-CVE-2019-3810 http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-64372 http://packetstormsecurity.com/files/162399/Moodle-3.6.1-Cross-Site-Scripting.html https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3810 https://moodle.org/mod/forum/discuss.php?d=381230#p1536767 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •