Permissions, Privileges, and Access Controls in Moodle - CVE-2019-3850
Published: March 19, 2019
Vulnerability identifier: #VU18020
CSH Severity: Low
CVSS v4: 2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2019-3850
CWE-ID: CWE-264
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to bypass certain security restrictions.
The vulnerability exists due to the application allows links within assignment submission comments to be opened directly in the same window. Such application behavior can lead phishing attacks.
Affected software
Moodle
How to mitigate CVE-2019-3850
Install updates from vendor's website.
Moodle - addressed in versions 3.1.17, 3.4.8, 3.5.5, 3.6.3