p PatchFirst

CVE-2019-14883

CVE-2019-14883

This page contains facts from public vulnerability sources. Check the original advisory before updating.

A vulnerability was found in Moodle 3.6 before 3.6.7 and 3.7 before 3.7.3, where tokens used to fetch inline atachments in email notifications were not disabled when a user's account was no longer active. Note: to access files, a user would need to know the file path, and their token.

CVSS 3.7 · Low · EPSS 1.1% · Fix available

Published
Updated

Stack: php

Affected products and versions

  • moodle

    Versions
    • 3.7.3: Affected
    • 3.6.7: Affected

    No fix published

  • moodle/moodle Packagist

    Versions
    • v3.6.0
    • v3.6.0-beta
    • v3.6.0-rc1
    • v3.6.0-rc2
    • v3.6.0-rc3
    • v3.6.1
    • v3.6.2
    • v3.6.3
    • v3.6.4
    • v3.6.5
    • v3.6.6
    Affected ranges
    • ECOSYSTEM: ≥ 3.6, < 3.6.7

    Update to 3.6.7

  • moodle/moodle Packagist

    Versions
    • v3.7.0
    • v3.7.0-beta
    • v3.7.0-rc1
    • v3.7.0-rc2
    • v3.7.1
    • v3.7.2
    Affected ranges
    • ECOSYSTEM: ≥ 3.7, < 3.7.3

    Update to 3.7.3

Original sources

Check your server →