CVE-2019-3851: Insecure Link in Moodle Secure Layout in Boost Theme
Summary
CVE-2019-3851: Moodle Secure layout contained an insecure link in Boost theme. Affects moodle/moodle across 2 version ranges.
>= 3.5, < 3.5.5
>= 3.6, < 3.6.3
Fixed in 3.5.5 or 3.6.3, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning management system (LMS) used by educational institutions to create and deliver online courses. It provides a platform for educators to manage and organize course materials, facilitate communication with students, and track their progress. The Boost theme is a popular theme in Moodle that offers a modern and responsive layout for the user interface. However, prior to versions 3.6.3 and 3.5.5, the Boost theme's secure layout contained an insecure link that allowed students to navigate out of the page.
Vulnerability Detail
The vulnerability in Moodle's Boost theme allowed students to access a link to the site home within the secure layout. This insecure link could potentially lead to unauthorized navigation away from the intended page, compromising the user experience and potentially exposing sensitive information. The vulnerability has a CVSS score of 4.3, indicating a moderate severity level.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 3.5, < 3.5.53.5.5composer require moodle/moodle:3.5.5 -
>= 3.6, < 3.6.33.6.3composer require moodle/moodle:3.6.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended solution is to upgrade to the patched versions of Moodle.
Conclusion
In conclusion, the vulnerability in Moodle's Boost theme allowed students to navigate out of the page within the secure layout. To mitigate this issue, it is recommended to upgrade to the patched versions of Moodle. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for moodle/moodle →
FAQ
Moodle is an open-source learning management system used by educational institutions to create and deliver online courses.
The Boost theme is a popular theme in Moodle that offers a modern and responsive layout for the user interface.
The vulnerability allows students to navigate out of the page within the Boost theme's secure layout, potentially compromising the user experience and exposing sensitive information.
The vulnerability has a CVSS score of 4.3, indicating a moderate severity level.
To fix this vulnerability, users should upgrade to Moodle versions 3.6.3 or 3.5.5, which include the necessary patches.
References
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
