GitHub Advisoryadvisory · Packagist

GHSA-qrcj-6fjw-3h9h Moodle XSS Vulnerability

MEDIUM Published 2022-05-13 Modified 2023-09-28 Official page ↗
Aliases
CVE-2019-3847
Ecosystem
Packagist
Packages
moodle/moodle
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2023-07-18

Affected packages

• Packagist moodle/moodle: >= 3.6.0, < 3.6.3 → fixed in 3.6.3 • Packagist moodle/moodle: >= 3.5.0, < 3.5.5 → fixed in 3.5.5 • Packagist moodle/moodle: >= 3.2.0, < 3.4.8 → fixed in 3.4.8 • Packagist moodle/moodle: < 3.1.17 → fixed in 3.1.17

Description

A vulnerability was found in moodle before versions 3.6.3, 3.5.5, 3.4.8 and 3.1.17. Users with the "login as other users" capability (such as administrators/managers) can access other users' Dashboards, but the JavaScript those other users may have added to their Dashboard was not being escaped when being viewed by the user logging in on their behalf.

Related

Alias · CVE (1)

  • CVE-2019-3847 A vulnerability was found in moodle before versions 3.6.3, 3.5.5, 3.4.8 and 3.1.17. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References