GitHub Advisoryadvisory · Packagist

GHSA-5wg9-5w3f-hxmh Moodle Users could elevate their role when accessing the LTI tool on a provider site

HIGH Published 2022-05-13 Modified 2024-01-26 Official page ↗
Aliases
CVE-2019-3849
Ecosystem
Packagist
Packages
moodle/moodle
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-269
Reviewed
2024-01-26

Affected packages

• Packagist moodle/moodle: < 3.4.8 → fixed in 3.4.8 • Packagist moodle/moodle: >= 3.5, < 3.5.5 → fixed in 3.5.5 • Packagist moodle/moodle: >= 3.6, < 3.6.3 → fixed in 3.6.3

Description

A vulnerability was found in moodle before versions 3.6.3, 3.5.5 and 3.4.8. Users could assign themselves an escalated role within courses or content accessed via LTI, by modifying the request to the LTI publisher site.

Related

Alias · CVE (1)

  • CVE-2019-3849 A vulnerability was found in moodle before versions 3.6.3, 3.5.5 and 3.4.8. vulnerability

Weakness · CWE (1)

  • CWE-269 Improper Privilege Management weakness

References