JavaScript Injection Vulnerability in Moodle, Affected by Unauthorized User Access
CVE-2019-3847

5.4MEDIUM

Key Information:

Vendor

[unknown]

Status
Vendor
CVE Published:
27 March 2019

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2019-3847?

A vulnerability exists in Moodle versions prior to 3.6.3, 3.5.5, 3.4.8, and 3.1.17, allowing users with permissions to log in as other users to view their Dashboards without proper sanitization. This flaw permits the display of unescaped JavaScript code included by the original user, potentially leading to harmful exploits that could compromise user data. Administrators and managers who utilize the 'login as other users' feature are particularly at risk, as they can inadvertently expose sensitive information through malicious scripts.

Affected Version(s)

Moodle 3.6 to 3.6.2

Moodle 3.5 to 3.5.4

Moodle 3.4 to 3.4.7

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

References

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

.