Improper Authorization in Moodle - CVE-2019-3852
Published: March 19, 2019
Vulnerability identifier: #VU18022
CSH Severity: Low
CVSS v4: 2.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2019-3852
CWE-ID: CWE-285
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to bypass certain security restrictions.
The vulnerability exists due to get_with_capability_join() and get_users_by_capability() methods did not take into consideration current activity status of the account (e.g. if the account is frozen or not) when checking user capabilities.
Affected software
Moodle
How to mitigate CVE-2019-3852
Install updates from vendor's website.
Moodle - update to 3.6.3