GitHub Advisoryadvisory · Packagist

GHSA-4r2p-wpv5-683w Moodle XSS Vulnerability

MEDIUM Published 2022-05-13 Modified 2023-09-28 Official page ↗
Aliases
CVE-2019-3808
Ecosystem
Packagist
Packages
moodle/moodle
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2023-07-19

Affected packages

• Packagist moodle/moodle: >= 3.6.0, < 3.6.2 → fixed in 3.6.2 • Packagist moodle/moodle: >= 3.5.0, < 3.5.4 → fixed in 3.5.4 • Packagist moodle/moodle: >= 3.2.0, < 3.4.7 → fixed in 3.4.7 • Packagist moodle/moodle: < 3.1.16 → fixed in 3.1.16

Description

A flaw was found in Moodle versions 3.6 to 3.6.1, 3.5 to 3.5.3, 3.4 to 3.4.6, 3.1 to 3.1.15 and earlier unsupported versions. The 'manage groups' capability did not have the 'XSS risk' flag assigned to it, but does have that access in certain places. Note that the capability is intended for use by trusted users, and is only assigned to teachers and managers by default.

Related

Alias · CVE (1)

  • CVE-2019-3808 A flaw was found in Moodle versions 3.6 to 3.6.1, 3.5 to 3.5.3, 3.4 to 3.4.6, 3.1 to 3.1.15 and earlier unsupported versions. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References