Multiple vulnerabilities in Moodle

1) Improper Authorization

EUVDB-ID: #VU18022

Risk: Low

CVSSv3.1: 2.7 [CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-3852

CWE-ID: CWE-285 - Improper Authorization

Exploit availability: No

Description

The vulnerability allows a remote attacker to bypass certain security restrictions.

The vulnerability exists due to get_with_capability_join() and get_users_by_capability() methods did not take into consideration current activity status of the account (e.g. if the account is frozen or not) when checking user capabilities.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Moodle: 3.6.0 - 3.6.2

External links

http://moodle.org/mod/forum/discuss.php?d=384015

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU18021

Risk: Low

CVSSv3.1: 2.3 [CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-3851

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a remote attacker to bypass certain security restrictions.

The vulnerability exists due to the application contains a link to site home within the the Boost theme's secure layout that can lead to students navigating out of the page.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Moodle: 3.5.0 - 3.6.2

External links

http://moodle.org/mod/forum/discuss.php?d=384014

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU18020

Risk: Low

CVSSv3.1: 2.3 [CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-3850

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a remote attacker to bypass certain security restrictions.

The vulnerability exists due to the application allows links within assignment submission comments to be opened directly in the same window. Such application behavior can lead phishing attacks.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Moodle: 3.1.0 - 3.6.2

External links

http://moodle.org/mod/forum/discuss.php?d=384013

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU18019

Risk: Medium

CVSSv3.1: 5.5 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-3849

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a remote attacker to escalate privileges within the application.

The vulnerability exists due to an error that allows authenticated users to assign themselves an escalated role within courses or content accessed via LTI by modifying the request to the LTI publisher site. A remote authenticated attacker can escalate privileges within the application.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Moodle: 3.3.0 - 3.6.2

External links

http://moodle.org/mod/forum/discuss.php?d=384012

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Stored cross-site scripting

EUVDB-ID: #VU18018

Risk: Medium

CVSSv3.1: 4.9 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:P/RL:O/RC:C]

CVE-ID: CVE-2019-3847

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: Yes

Description

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data in user's Dashboard. A remote authenticated attacker can permanently inject JavaScript into Dashboard and execute it victim's browser in context of vulnerable website, when a privileged user with "login as other users" capability view compromised Dashboard on attackers behalf.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Moodle: 3.1.0 - 3.6.2

External links

http://moodle.org/mod/forum/discuss.php?d=384010

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

6) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU18017

Risk: Low

CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-3848

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to incorrect implementation of permissions checks when loading event information into the calendar's edit event modal popup. A remote authenticated attacker can view contents of calendar events that belong to other users.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Moodle: 3.3.4 - 3.6.2

External links

http://moodle.org/mod/forum/discuss.php?d=384011

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.