JavaScript Injection Vulnerability in Moodle, Affected by Unauthorized User Access
CVE-2019-3847
Key Information:
Badges
What is CVE-2019-3847?
A vulnerability exists in Moodle versions prior to 3.6.3, 3.5.5, 3.4.8, and 3.1.17, allowing users with permissions to log in as other users to view their Dashboards without proper sanitization. This flaw permits the display of unescaped JavaScript code included by the original user, potentially leading to harmful exploits that could compromise user data. Administrators and managers who utilize the 'login as other users' feature are particularly at risk, as they can inadvertently expose sensitive information through malicious scripts.
Affected Version(s)
Moodle 3.6 to 3.6.2
Moodle 3.5 to 3.5.4
Moodle 3.4 to 3.4.7
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.