GHSA-4r2p-wpv5-683w
Moodle XSS Vulnerability
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Packagist | moodle/moodle | >= 3.6.0, < 3.6.2 | 3.6.2 |
| Packagist | moodle/moodle | >= 3.5.0, < 3.5.4 | 3.5.4 |
| Packagist | moodle/moodle | >= 3.2.0, < 3.4.7 | 3.4.7 |
| Packagist | moodle/moodle | < 3.1.16 | 3.1.16 |
Details
As written in the advisory (Markdown source, shown as plain text).
A flaw was found in Moodle versions 3.6 to 3.6.1, 3.5 to 3.5.3, 3.4 to 3.4.6, 3.1 to 3.1.15 and earlier unsupported versions. The 'manage groups' capability did not have the 'XSS risk' flag assigned to it, but does have that access in certain places. Note that the capability is intended for use by trusted users, and is only assigned to teachers and managers by default.
References
External links from the advisory. They lead to third-party sites.
- https://nvd.nist.gov/vuln/detail/CVE-2019-3808
- https://github.com/moodle/moodle/commit/6360f87cdca744a6a71c315853f6d811a3e54e26
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3808
- https://github.com/moodle/moodle
- https://moodle.org/mod/forum/discuss.php?d=381228#p1536765
- http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-64395