Role Escalation Vulnerability in Moodle by Moodle HQ
CVE-2019-3849

6.3MEDIUM

Key Information:

Vendor

[unknown]

Status
Moodle
Vendor
CVE Published:
26 March 2019

What is CVE-2019-3849?

A role escalation vulnerability exists in Moodle before versions 3.6.3, 3.5.5, and 3.4.8, where users could potentially manipulate requests to the LTI publisher site. This manipulation enabled users to assign themselves elevated roles within courses or other content accessed via LTI, compromising the integrity of course management and user permissions.

Affected Version(s)

moodle 3.6.3

moodle 3.5.5

moodle 3.4.8

References

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3849
x_refsource_CONFIRM
https://moodle.org/mod/forum/discuss.php?d=384012#p1547744
x_refsource_MISC

CVSS V3.1

Score:
6.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

CVSS V3.0

Score:
6.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.