Unauthorized Access in Moodle Calendar Functionality
CVE-2019-3848

4.3MEDIUM

Key Information:

Vendor

[unknown]

Status
Moodle
Vendor
CVE Published:
26 March 2019

What is CVE-2019-3848?

A vulnerability in Moodle prior to specific versions allows logged-in non-guest users to access unauthorized calendar events. Due to improper permission checks in the event loading process, affected users could view event details without permission to edit them. This issue highlights the importance of robust access control measures to protect sensitive information from unauthorized visibility.

Affected Version(s)

moodle 3.6.3

moodle 3.5.5

moodle 3.4.8

References

https://moodle.org/mod/forum/discuss.php?d=384011#p1547743
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3848

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.