VULNERABILITY INTELLIGENCE

CVE-2019-3809

CVSS score6.5 MEDIUM
EPSS probability0.84%
CISA KEVNot currently listed
Published2019-03-25
Last modified2026-06-17
CVSS vectorCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Description

A flaw was found in Moodle versions 3.1 to 3.1.15 and earlier unsupported versions. The mybackpack functionality allowed setting the URL of badges, when it should be restricted to the Mozilla Open Badges backpack URL. This resulted in the possibility of blind SSRF via requests made by the page.

Weakness classification

  • CWE-352: Cross-Site Request Forgery (CSRF)
  • CWE-918: Server-Side Request Forgery (SSRF)

Primary references