CVSS: 8.8EPSS: 0%CPEs: 3EXPL: 0CVE-2019-3849
https://notcve.org/view.php?id=CVE-2019-3849
A vulnerability was found in moodle before versions 3.6.3, 3.5.5 and 3.4.8. Users could assign themselves an escalated role within courses or content accessed via LTI, by modifying the request to the LTI publisher site. Se ha detectado una vulnerabilidad en moodle, en versiones anteriores a la 3.6.3, 3.5.5 y 3.4.8. Los usuarios podrían autoasignarse un rol escalado en los cursos o el contenido al que se accede mediante LTI modificando la petición al sitio LTI del editor. • https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3849 https://moodle.org/mod/forum/discuss.php?d=384012#p1547744 • CWE-269: Improper Privilege Management CWE-285: Improper Authorization •
CVSS: 4.3EPSS: 0%CPEs: 3EXPL: 0CVE-2019-3848
https://notcve.org/view.php?id=CVE-2019-3848
A vulnerability was found in moodle before versions 3.6.3, 3.5.5 and 3.4.8. Permissions were not correctly checked before loading event information into the calendar's edit event modal popup, so logged in non-guest users could view unauthorised calendar events. (Note: It was read-only access, users could not edit the events.) Se ha detectado una vulnerabilidad en moodle, en versiones anteriores a la 3.6.3, 3.5.5 y 3.4.8. Los permisos no se comprobaban correctamente antes de cargar información de eventos en la ventana emergente modal de edición de eventos del calendario, por lo que los usuarios no invitados que hayan iniciado sesión podrían visualizar eventos de calendario no autorizados. • https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3848 https://moodle.org/mod/forum/discuss.php?d=384011#p1547743 • CWE-863: Incorrect Authorization •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2019-3809
https://notcve.org/view.php?id=CVE-2019-3809
A flaw was found in Moodle versions 3.1 to 3.1.15 and earlier unsupported versions. The mybackpack functionality allowed setting the URL of badges, when it should be restricted to the Mozilla Open Badges backpack URL. This resulted in the possibility of blind SSRF via requests made by the page. Se ha encontrado un error en Moodle, en versiones 3.1 a 3.1.15 y versiones anteriores sin soporte. La funcionalidad ‘‘mybackpack’’ ha permitido establecer la URL de las insignias cuando debería estar restringida la URL del ‘‘backpack’’ de Mozilla Open Badges. • http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-64222 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3809 https://moodle.org/mod/forum/discuss.php?d=381229#p1536766 • CWE-352: Cross-Site Request Forgery (CSRF) CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 5.4EPSS: 0%CPEs: 5EXPL: 0CVE-2019-3808
https://notcve.org/view.php?id=CVE-2019-3808
A flaw was found in Moodle versions 3.6 to 3.6.1, 3.5 to 3.5.3, 3.4 to 3.4.6, 3.1 to 3.1.15 and earlier unsupported versions. The 'manage groups' capability did not have the 'XSS risk' flag assigned to it, but does have that access in certain places. Note that the capability is intended for use by trusted users, and is only assigned to teachers and managers by default. Se ha encontrado un error en Moodle, en versiones 3.4 a 3.6.1, 3.3 a 3.5.3, 3.2 a 3.4.6 y 3.1 a 3.1.15, así como en versiones anteriores sin soporte. La funcionalidad ‘‘manage groups’’ no tenía el flag ‘‘XSS risk’’ asignado, pero tiene ese tipo de acceso a ciertos lugares. • http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-64395 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3808 https://moodle.org/mod/forum/discuss.php?d=381228#p1536765 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 1%CPEs: 4EXPL: 3CVE-2019-3810 – Moodle 3.6.1 - Persistent Cross-Site Scripting (XSS)
https://notcve.org/view.php?id=CVE-2019-3810
A flaw was found in moodle versions 3.6 to 3.6.1, 3.5 to 3.5.3, 3.4 to 3.4.6, 3.1 to 3.1.15 and earlier unsupported versions. The /userpix/ page did not escape users' full names, which are included as text when hovering over profile images. Note this page is not linked to by default and its access is restricted. Se ha encontrado un error en Moodle, desde la versión 3.6 hasta la 3.6.1, de la 3.5 a la 3.5.3, de la 3.4 a la 3.4.6 y desde la 3.1 hasta la 3.1.15, así como en versiones anteriores sin soporte. La página /userprix/ no escapó los nombres completos de los usuarios, que están incluidos como texto al desplazarse sobre las imágenes. • https://www.exploit-db.com/exploits/49814 https://github.com/farisv/Moodle-CVE-2019-3810 http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-64372 http://packetstormsecurity.com/files/162399/Moodle-3.6.1-Cross-Site-Scripting.html https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3810 https://moodle.org/mod/forum/discuss.php?d=381230#p1536767 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •