GitHub Advisoryadvisory · Packagist

GHSA-xj5f-qv37-r9jc Moodle Login CSRF vulnerability in login form

HIGH Published 2022-05-13 Modified 2024-04-23 Official page ↗
Aliases
CVE-2018-16854
Ecosystem
Packagist
Packages
moodle/moodle
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-352
Reviewed
2024-04-23

Affected packages

• Packagist moodle/moodle: >= 3.1, < 3.1.15 → fixed in 3.1.15 • Packagist moodle/moodle: >= 3.3, < 3.3.9 → fixed in 3.3.9 • Packagist moodle/moodle: >= 3.4, < 3.4.6 → fixed in 3.4.6 • Packagist moodle/moodle: >= 3.5, < 3.5.3 → fixed in 3.5.3

Description

A flaw was found in moodle versions 3.5 to 3.5.2, 3.4 to 3.4.5, 3.3 to 3.3.8, 3.1 to 3.1.14 and earlier. The login form is not protected by a token to prevent login cross-site request forgery. Fixed versions include 3.6, 3.5.3, 3.4.6, 3.3.9 and 3.1.15.

Related

Alias · CVE (1)

  • CVE-2018-16854 A flaw was found in moodle versions 3.5 to 3.5.2, 3.4 to 3.4.5, 3.3 to 3.3.8, 3.1 to 3.1.14 and earlier. vulnerability

Weakness · CWE (1)

  • CWE-352 Cross-Site Request Forgery weakness

References