p PatchFirst

PatchFirst · Latest vulnerabilities

moodle/moodle vulnerabilities · Page 12

Vulnerabilities published for moodle/moodle in the last 30 days: 0. Listed in the KEV catalogue: 0.

RSS ↗ JSON ↗
Filter vulnerabilities
Clear filters

Vulnerabilities: 437

  10. CVE-2019-3847

    Medium · CVSS 5.4EPSS 2.22%Fix available

    CVE-2019-3847

    A vulnerability was found in moodle before versions 3.6.3, 3.5.5, 3.4.8 and 3.1.17. Users with the "login as other users" capability (such as administrators/managers) can access other users' Dashboards, but the JavaScript those other users may have added to their Dashboard was not being escaped when being viewed by the user logging in on their behalf.

    moodle/moodle moodle/moodle moodle/moodle moodle/moodlePHP
    • Update to 3.1.17
    • Update to 3.4.8
    • Update to 3.5.5
    • Update to 3.6.3
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  13. CVE-2019-3850

    Medium · CVSS 4.3EPSS 0.95%Fix available

    CVE-2019-3850

    A vulnerability was found in moodle before versions 3.6.3, 3.5.5, 3.4.8 and 3.1.17. Links within assignment submission comments would open directly (in the same window). Although links themselves may be valid, opening within the same window and without the no-referrer header policy made them more susceptible to exploits.

    moodle/moodle moodle/moodle moodle/moodle moodle/moodlePHP
    • Update to 3.1.17
    • Update to 3.4.8
    • Update to 3.5.5
    • Update to 3.6.3
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  15. CVE-2019-3848

    Medium · CVSS 4.3EPSS 0.92%Fix available

    CVE-2019-3848

    A vulnerability was found in moodle before versions 3.6.3, 3.5.5 and 3.4.8. Permissions were not correctly checked before loading event information into the calendar's edit event modal popup, so logged in non-guest users could view unauthorised calendar events. (Note: It was read-only access, users could not edit the events.)

    moodle/moodle moodle/moodle moodle/moodlePHP
    • Update to 3.4.8
    • Update to 3.5.5
    • Update to 3.6.3
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  16. CVE-2019-3809

    Medium · CVSS 6.5EPSS 0.84%Fix available

    CVE-2019-3809

    A flaw was found in Moodle versions 3.1 to 3.1.15 and earlier unsupported versions. The mybackpack functionality allowed setting the URL of badges, when it should be restricted to the Mozilla Open Badges backpack URL. This resulted in the possibility of blind SSRF via requests made by the page.

    moodle/moodlePHP
    • Update to 3.1.16
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  17. CVE-2019-3808

    Medium · CVSS 4.3EPSS 1.23%Fix available

    CVE-2019-3808

    A flaw was found in Moodle versions 3.6 to 3.6.1, 3.5 to 3.5.3, 3.4 to 3.4.6, 3.1 to 3.1.15 and earlier unsupported versions. The 'manage groups' capability did not have the 'XSS risk' flag assigned to it, but does have that access in certain places. Note that the capability is intended for use by trusted users, and is only assigned to teachers and managers by default.

    moodle/moodle moodle/moodle moodle/moodle moodle/moodlePHP
    • Update to 3.1.16
    • Update to 3.4.7
    • Update to 3.5.4
    • Update to 3.6.2
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  18. CVE-2019-3810

    Medium · CVSS 4.3EPSS 13.84%Public exploitFix available

    CVE-2019-3810

    A flaw was found in moodle versions 3.6 to 3.6.1, 3.5 to 3.5.3, 3.4 to 3.4.6, 3.1 to 3.1.15 and earlier unsupported versions. The /userpix/ page did not escape users' full names, which are included as text when hovering over profile images. Note this page is not linked to by default and its access is restricted.

    moodle/moodle moodle/moodle moodle/moodle moodle/moodlePHP
    • Update to 3.1.15
    • Update to 3.4.6
    • Update to 3.5.3
    • Update to 3.6.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  20. CVE-2018-16854

    Medium · CVSS 6.5EPSS 2.33%Fix available

    CVE-2018-16854

    A flaw was found in moodle versions 3.5 to 3.5.2, 3.4 to 3.4.5, 3.3 to 3.3.8, 3.1 to 3.1.14 and earlier. The login form is not protected by a token to prevent login cross-site request forgery. Fixed versions include 3.6, 3.5.3, 3.4.6, 3.3.9 and 3.1.15.

    moodle/moodle moodle/moodle moodle/moodle moodle/moodlePHP
    • Update to 3.1.15
    • Update to 3.3.9
    • Update to 3.4.6
    • Update to 3.5.3
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →