Reflected XSS Vulnerability in Moodle by Moodle Pty Ltd
CVE-2019-14884

6.1MEDIUM

Key Information:

Vendor

[unknown]

Status
Moodle
Vendor
CVE Published:
18 March 2020

What is CVE-2019-14884?

A reflected Cross-Site Scripting (XSS) vulnerability exists in Moodle versions prior to 3.7.3, 3.6.7, and 3.5.9. This security issue can be exploited through certain fatal error messages, allowing attackers to inject malicious scripts into web pages. Users should ensure they are using the updated versions of the software to mitigate this risk. For more detailed information, visit the official forums and security announcements.

Affected Version(s)

moodle 3.7.3

moodle 3.6.7

moodle 3.5.9

References

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14884
x_refsource_CONFIRM
https://moodle.org/mod/forum/discuss.php?d=393587#p1586751
x_refsource_CONFIRM

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.