#VU18019 Permissions, Privileges, and Access Controls in Moodle - CVE-2019-3849

Vulnerability identifier: #VU18019

Vulnerability risk: Medium

CVSSv4.0: 1.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2019-3849

CWE-ID: CWE-264

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
Moodle
Web applications / Other software

Vendor: moodle.org

Description

The vulnerability allows a remote attacker to escalate privileges within the application.

The vulnerability exists due to an error that allows authenticated users to assign themselves an escalated role within courses or content accessed via LTI by modifying the request to the LTI publisher site. A remote authenticated attacker can escalate privileges within the application.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

Moodle: 3.3.0 - 3.3.9, 3.4.0 - 3.4.7, 3.5.0 - 3.5.4, 3.6.0 - 3.6.2

---

External links
https://moodle.org/mod/forum/discuss.php?d=384012

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.