CVE-2019-3852: Moodle context freezing
Summary
CVE-2019-3852: Moodle context freezing. Affects moodle/moodle versions >= 3.6, < 3.6.3. Fixed in 3.6.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning management system (LMS) used by educational institutions worldwide. It provides a platform for creating and managing online courses, allowing educators to deliver content and interact with students. Moodle is widely used due to its flexibility, extensibility, and community support. However, a vulnerability has been discovered in Moodle before version 3.6.3.
Vulnerability Detail
The vulnerability, identified as CVE-2019-3852, stems from the get_with_capability_join and get_users_by_capability functions in Moodle. These functions fail to consider context freezing when checking user capabilities. As a result, an attacker with limited privileges may exploit this flaw to gain unauthorized access or perform actions beyond their intended scope. The impact of this vulnerability can range from unauthorized data access to potential privilege escalation.
How To Fix
Minimum fixed version
3.6.3
This is the first release that contains the fix.
composer require moodle/moodle:3.6.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No specific workaround has been provided for this vulnerability. It is crucial to apply the official patch or upgrade to the latest version of Moodle to mitigate the risk effectively.
Conclusion
In conclusion, the vulnerability in Moodle before version 3.6.3 allows attackers with limited privileges to potentially gain unauthorized access or perform unauthorized actions. It is crucial for administrators to upgrade their Moodle installations to the latest version or apply the official patch to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for moodle/moodle →
FAQ
Moodle is an open-source learning management system (LMS) used by educational institutions to create and manage online courses.
The vulnerability allows attackers with limited privileges to potentially gain unauthorized access or perform actions beyond their intended scope.
To fix this vulnerability, it is recommended to upgrade Moodle to version 3.6.3 or later.
No specific workaround has been provided. It is essential to apply the official patch or upgrade to the latest version of Moodle.
For more information about this vulnerability, you can refer to the CVE-2019-3852 advisory or contact the Moodle support team.
References
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
