Vulnerability Details : CVE-2019-3849
A vulnerability was found in moodle before versions 3.6.3, 3.5.5 and 3.4.8. Users could assign themselves an escalated role within courses or content accessed via LTI, by modifying the request to the LTI publisher site.
Vulnerability category: BypassGain privilege
Products affected by CVE-2019-3849
- cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*
- cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*
- cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2019-3849
0.37%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 56 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2019-3849
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
6.5
|
MEDIUM | AV:N/AC:L/Au:S/C:P/I:P/A:P |
8.0
|
6.4
|
NIST | |
|
6.3
|
MEDIUM | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L |
2.8
|
3.4
|
Red Hat, Inc. | |
|
8.8
|
HIGH | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
2.8
|
5.9
|
NIST |
CWE ids for CVE-2019-3849
-
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.Assigned by: nvd@nist.gov (Primary)
-
The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.Assigned by: secalert@redhat.com (Secondary)
References for CVE-2019-3849
-
https://moodle.org/mod/forum/discuss.php?d=384012#p1547744
Moodle.org: MSA-19-0006: Users could elevate their role when accessing the LTI tool on a provider sitePatch;Vendor Advisory
-
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3849
1692908 – (CVE-2019-3849) CVE-2019-3849 moodle: Users could elevate their role when accessing the LTI tool on a provider siteIssue Tracking;Patch;Third Party Advisory
Jump to