CVE-2019-3848: Moodle - Logged in users could view all calendar events
Summary
CVE-2019-3848: Moodle Logged in users could view all calendar events. Affects moodle/moodle across 3 version ranges.
>= 3.4, < 3.4.8
>= 3.5, < 3.5.5
>= 3.6, < 3.6.3
Fixed in 3.4.8, 3.5.5 or 3.6.3, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning management system used by educational institutions to create online courses and manage student interactions. It provides various features, including a calendar module that allows users to schedule and view events. However, a vulnerability was discovered in Moodle versions before 3.6.3, 3.5.5, and 3.4.8, where permissions were not properly checked when loading event information into the calendar's edit event modal popup. This flaw allowed logged in non-guest users to view unauthorized calendar events. It's important to note that this access was read-only, and users were unable to edit the events.
Vulnerability Detail
The vulnerability in Moodle allowed logged in non-guest users to view calendar events that they were not authorized to access. This issue arose due to the lack of proper permission checks when loading event information into the calendar's edit event modal popup. Although users could only view the events and not make any modifications, this still posed a privacy concern as sensitive information could be exposed. The vulnerability has a CVSS score of 4.3, indicating a moderate severity level.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 3.4, < 3.4.83.4.8composer require moodle/moodle:3.4.8 -
>= 3.5, < 3.5.53.5.5composer require moodle/moodle:3.5.5 -
>= 3.6, < 3.6.33.6.3composer require moodle/moodle:3.6.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. The recommended solution is to upgrade to the patched versions of Moodle.
Conclusion
In conclusion, the vulnerability in Moodle allowed logged in non-guest users to view unauthorized calendar events. Although it was read-only access and users could not edit the events, this still posed a privacy concern. To mitigate this vulnerability, it is crucial to upgrade to Moodle versions 3.6.3, 3.5.5, or 3.4.8. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for moodle/moodle →
FAQ
Moodle is an open-source learning management system used by educational institutions to create online courses and manage student interactions.
Moodle versions before 3.6.3, 3.5.5, and 3.4.8 are affected by this vulnerability.
An attacker cannot exploit this vulnerability to modify calendar events. However, they can view unauthorized calendar events, potentially exposing sensitive information.
Yes, the vulnerability has been fixed in Moodle versions 3.6.3, 3.5.5, and 3.4.8. It is recommended to upgrade to these versions or newer.
The vulnerability has a CVSS score of 4.3, indicating a moderate severity level.
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
