VULNERABILITY INTELLIGENCE

CVE-2019-3849

CVSS score8.8 HIGH

EPSS probability1.02%

CISA KEVNot currently listed

Published2019-03-26

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Description

A vulnerability was found in moodle before versions 3.6.3, 3.5.5 and 3.4.8. Users could assign themselves an escalated role within courses or content accessed via LTI, by modifying the request to the LTI publisher site.

Weakness classification

CWE-269: Improper Privilege Management
CWE-285: Improper Authorization

Primary references

secalert@redhat.com — Issue Tracking, Patch, Third Party Advisory
secalert@redhat.com — Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Issue Tracking, Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Patch, Vendor Advisory