CSRF Token Vulnerability in Moodle by Moodle

CVE-2019-10186

What is CVE-2019-10186?

A security flaw was identified in Moodle's handling of the XML loading and unloading admin tool. Specifically, prior to version 3.7.1, the application did not properly utilize a sesskey (CSRF) token, potentially allowing an attacker to perform unauthorized actions by exploiting this oversight. This could lead to various security risks, as it bypasses vital security mechanisms designed to protect against CSRF attacks. It is crucial for users to update their Moodle installations to the latest versions to mitigate this vulnerability.

References