p PatchFirst

CVE-2019-3809

CVE-2019-3809

This page contains facts from public vulnerability sources. Check the original advisory before updating.

A flaw was found in Moodle versions 3.1 to 3.1.15 and earlier unsupported versions. The mybackpack functionality allowed setting the URL of badges, when it should be restricted to the Mozilla Open Badges backpack URL. This resulted in the possibility of blind SSRF via requests made by the page.

CVSS 6.5 · Medium · EPSS 0.8% · Fix available

Published
Updated

Stack: system · php

Affected products and versions

  • moodle

    Versions
    • 3.1.16: Affected

    No fix published

  • moodle/moodle Packagist

    Versions
    • v3.1.0
    • v3.1.0-beta
    • v3.1.0-rc1
    • v3.1.0-rc2
    • v3.1.1
    • v3.1.10
    • v3.1.11
    • v3.1.12
    • v3.1.13
    • v3.1.14
    • v3.1.15
    • v3.1.2
    • v3.1.3
    • v3.1.4
    • v3.1.5
    • v3.1.6
    • v3.1.7
    • v3.1.8
    • v3.1.9
    Affected ranges
    • ECOSYSTEM: ≥ 3.1, < 3.1.16

    Update to 3.1.16

  • moodle Ubuntu:Pro:16.04:LTS

    Versions
    • 2.7.9+dfsg-1
    • 2.7.10+dfsg-1
    • 2.7.11+dfsg-1
    • 2.7.11+dfsg-2
    • 2.7.12+dfsg-1
    • 3.0.3+dfsg-0ubuntu1
    Affected ranges
    • ECOSYSTEM: < 3.0.3+dfsg-0ubuntu1+esm1

    Update to 3.0.3+dfsg-0ubuntu1+esm1

  • moodle Ubuntu:Pro:18.04:LTS

    Versions
    • 3.0.3+dfsg-0ubuntu1
    Affected ranges
    • ECOSYSTEM: < 3.0.3+dfsg-0ubuntu1+esm1

    Update to 3.0.3+dfsg-0ubuntu1+esm1

Original sources

Check your server →