GitHub Advisoryadvisory · Packagist

GHSA-g9m2-c2x5-fr2v Moodle does not revoke role capabilities correctly

MEDIUM Published 2022-05-24 Modified 2023-08-01 Official page ↗
Aliases
CVE-2019-14879
Ecosystem
Packagist
Packages
moodle/moodle
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Weaknesses
CWE-273
Reviewed
2023-08-01

Affected packages

• Packagist moodle/moodle: >= 3.7.0, < 3.7.3 → fixed in 3.7.3 • Packagist moodle/moodle: >= 3.6.0, < 3.6.7 → fixed in 3.6.7 • Packagist moodle/moodle: >= 3.5.0, < 3.5.9 → fixed in 3.5.9

Description

A vulnerability was found in Moodle versions 3.7.x before 3.7.3, 3.6.x before 3.6.7 and 3.5.x before 3.5.9. When a cohort role assignment was removed, the associated capabilities were not being revoked (where applicable).

Related

Alias · CVE (1)

  • CVE-2019-14879 A vulnerability was found in Moodle versions 3.7.x before 3.7.3, 3.6.x before 3.6.7 and 3.5.x before 3.5.9. vulnerability

Weakness · CWE (1)

  • CWE-273 Improper Check for Dropped Privileges weakness

References