CVE-2019-3848

Published: Mar 26, 2019Modified: Nov 21, 2024

4.3

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Exploitability: 2.8 / Impact: 1.4

Source: NVD

Description

A vulnerability was found in moodle before versions 3.6.3, 3.5.5 and 3.4.8. Permissions were not correctly checked before loading event information into the calendar's edit event modal popup, so logged in non-guest users could view unauthorised calendar events. (Note: It was read-only access, users could not edit the events.)

Affected (3)

Products: Moodle: Moodle

1 product

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Moodle Moodle	Before 3.4.8
Moodle Moodle	From 3.5.0 to 3.5.5
Moodle Moodle	From 3.6.0 to 3.6.3

Related CWEs

Incorrect Authorization

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.

References (4)

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3848

Source: secalert@redhat.com

Issue TrackingPatchThird Party Advisory

https://moodle.org/mod/forum/discuss.php?d=384011#p1547743

Source: secalert@redhat.com

PatchVendor Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3848

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingPatchThird Party Advisory

https://moodle.org/mod/forum/discuss.php?d=384011#p1547743

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

Timeline

No history available yet.